From 97385e1dcaad7ebe39c4ad33dbc802fe1ae50ac4 Mon Sep 17 00:00:00 2001 From: Antony Dovgal Date: Fri, 15 Feb 2008 09:33:00 +0000 Subject: [PATCH] recursion protection in count() --- ext/standard/array.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ext/standard/array.c b/ext/standard/array.c index 86c7db0e8a..781eceb31a 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -281,6 +281,11 @@ static int php_count_recursive(zval *array, long mode TSRMLS_DC) /* {{{ */ zval **element; if (Z_TYPE_P(array) == IS_ARRAY) { + if (Z_ARRVAL_P(array)->nApplyCount > 1) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected"); + return 0; + } + cnt = zend_hash_num_elements(Z_ARRVAL_P(array)); if (mode == COUNT_RECURSIVE) { HashPosition pos; @@ -289,7 +294,9 @@ static int php_count_recursive(zval *array, long mode TSRMLS_DC) /* {{{ */ zend_hash_get_current_data_ex(Z_ARRVAL_P(array), (void **) &element, &pos) == SUCCESS; zend_hash_move_forward_ex(Z_ARRVAL_P(array), &pos) ) { + Z_ARRVAL_P(array)->nApplyCount++; cnt += php_count_recursive(*element, COUNT_RECURSIVE TSRMLS_CC); + Z_ARRVAL_P(array)->nApplyCount--; } } } -- 2.50.1