From: Antony Dovgal <tony2001@php.net>
Date: Fri, 15 Feb 2008 09:33:26 +0000 (+0000)
Subject: MFH: recursion protection in count()
X-Git-Tag: php-5.2.6RC1~65
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e3189410c4b9c4d45484d4439a1ba5d60c945eae;p=php

MFH: recursion protection in count()
---

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 4c9da9f24e..98666f3cfa 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -283,6 +283,11 @@ static int php_count_recursive(zval *array, long mode TSRMLS_DC) /* {{{ */
 	zval **element;
 
 	if (Z_TYPE_P(array) == IS_ARRAY) {
+		if (Z_ARRVAL_P(array)->nApplyCount > 1) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
+			return 0;
+		}
+
 		cnt = zend_hash_num_elements(Z_ARRVAL_P(array));
 		if (mode == COUNT_RECURSIVE) {
 			HashPosition pos;
@@ -290,7 +295,9 @@ static int php_count_recursive(zval *array, long mode TSRMLS_DC) /* {{{ */
 			for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_P(array), &pos);
 				 zend_hash_get_current_data_ex(Z_ARRVAL_P(array), (void **) &element, &pos) == SUCCESS;
 				 zend_hash_move_forward_ex(Z_ARRVAL_P(array), &pos)) {
+				Z_ARRVAL_P(array)->nApplyCount++;
 				cnt += php_count_recursive(*element, COUNT_RECURSIVE TSRMLS_CC);
+				Z_ARRVAL_P(array)->nApplyCount--;
 			}
 		}
 	}