Patch max_input_vars.patch for *General Issues Bug #60655

Patch version 2012-01-05 05:03 UTC

Obsolete patches:

• max_input_vars.patch, revision 2012-01-05 04:08 UTC
• max_input_vars.patch, revision 2012-01-05 04:17 UTC
• max_input_vars.patch, revision 2012-01-05 05:02 UTC

Developer: laruence@php.net

Line 1210 (now 1210), was 208 lines, now 8 lines

  +	++(BG(unserialize).num_vars);
   	return object_common2(UNSERIALIZE_PASSTHRU, elements);
   }
   
 Index: branches/PHP_5_3/ext/json/json.c
 ===================================================================
 --- branches/PHP_5_3/ext/json/json.c	(revision 321767)
 +++ branches/PHP_5_3/ext/json/json.c	(working copy)
 @@ -76,6 +76,7 @@
  
  	REGISTER_LONG_CONSTANT("JSON_ERROR_NONE", PHP_JSON_ERROR_NONE, CONST_CS | CONST_PERSISTENT);
  	REGISTER_LONG_CONSTANT("JSON_ERROR_DEPTH", PHP_JSON_ERROR_DEPTH, CONST_CS | CONST_PERSISTENT);
 +	REGISTER_LONG_CONSTANT("JSON_ERROR_MAX_VARS", PHP_JSON_ERROR_MAX_VARS, CONST_CS | CONST_PERSISTENT);
  	REGISTER_LONG_CONSTANT("JSON_ERROR_STATE_MISMATCH", PHP_JSON_ERROR_STATE_MISMATCH, CONST_CS | CONST_PERSISTENT);
  	REGISTER_LONG_CONSTANT("JSON_ERROR_CTRL_CHAR", PHP_JSON_ERROR_CTRL_CHAR, CONST_CS | CONST_PERSISTENT);
  	REGISTER_LONG_CONSTANT("JSON_ERROR_SYNTAX", PHP_JSON_ERROR_SYNTAX, CONST_CS | CONST_PERSISTENT);
 @@ -485,7 +486,7 @@
  }
  /* }}} */
  
 -PHP_JSON_API void php_json_decode(zval *return_value, char *str, int str_len, zend_bool assoc, long depth TSRMLS_DC) /* {{{ */
 +PHP_JSON_API void php_json_decode_ex(zval *return_value, char *str, int str_len, zend_bool assoc, long depth, long max_vars TSRMLS_DC) /* {{{ */
  {
  	int utf16_len;
  	zval *z;
 @@ -510,7 +511,7 @@
  	}
  
  	ALLOC_INIT_ZVAL(z);
 -	jp = new_JSON_parser(depth);
 +	jp = new_JSON_parser(depth, max_vars);
  	if (parse_JSON(jp, z, utf16, utf16_len, assoc TSRMLS_CC)) {
  		*return_value = *z;
  	}
 @@ -584,8 +585,9 @@
  	int str_len;
  	zend_bool assoc = 0; /* return JS objects as PHP objects by default */
  	long depth = JSON_PARSER_DEFAULT_DEPTH;
 +	long max_vars = PG(max_input_vars);
  
 -	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|bl", &str, &str_len, &assoc, &depth) == FAILURE) {
 +	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|bll", &str, &str_len, &assoc, &depth, &max_vars) == FAILURE) {
  		return;
  	}
  
 @@ -595,7 +597,7 @@
  		RETURN_NULL();
  	}
  
 -	php_json_decode(return_value, str, str_len, assoc, depth TSRMLS_CC);
 +	php_json_decode_ex(return_value, str, str_len, assoc, depth, max_vars TSRMLS_CC);
  }
  /* }}} */
  
 Index: branches/PHP_5_3/ext/json/tests/json_decode_error.phpt
 ===================================================================
 --- branches/PHP_5_3/ext/json/tests/json_decode_error.phpt	(revision 321767)
 +++ branches/PHP_5_3/ext/json/tests/json_decode_error.phpt	(working copy)
 @@ -20,7 +20,7 @@
  
  echo "\n-- Testing json_decode() function with more than expected no. of arguments --\n";
  $extra_arg = 10;
 -var_dump( json_decode('"abc"', TRUE, 512, $extra_arg) );
 +var_dump( json_decode('"abc"', TRUE, 512, 1000, $extra_arg) );
  
  ?>
  ===Done===
 @@ -34,6 +34,6 @@
  
  -- Testing json_decode() function with more than expected no. of arguments --
  
 -Warning: json_decode() expects at most 3 parameters, 4 given in %s on line %d
 +Warning: json_decode() expects at most 4 parameters, 5 given in %s on line %d
  NULL
  ===Done===
 Index: branches/PHP_5_3/ext/json/JSON_parser.c
 ===================================================================
 --- branches/PHP_5_3/ext/json/JSON_parser.c	(revision 321767)
 +++ branches/PHP_5_3/ext/json/JSON_parser.c	(working copy)
 @@ -239,11 +239,12 @@
      JSON_checker_char will delete the JSON_checker object if it sees an error.
  */
  JSON_parser
 -new_JSON_parser(int depth)
 +new_JSON_parser(int depth, long max_vars)
  {
      JSON_parser jp = (JSON_parser)emalloc(sizeof(struct JSON_parser_struct));
      jp->state = GO;
      jp->depth = depth;
 +	jp->max_vars = max_vars;
      jp->top = -1;
  	jp->error_code = PHP_JSON_ERROR_NONE;
      jp->stack = (int*)ecalloc(depth, sizeof(int));
 @@ -426,6 +427,7 @@
      int next_class;  /* the next character class */
      int next_state;  /* the next state */
      int the_index;
 +	long num_vars = 1; /* the container is also counted in */
  
      smart_str buf = {0};
      smart_str key = {0};
 @@ -436,6 +438,11 @@
  	JSON_RESET_TYPE();
  
      for (the_index = 0; the_index < length; the_index += 1) {
 +		if (jp->max_vars && num_vars >= jp->max_vars) {
 +			jp->error_code = PHP_JSON_ERROR_MAX_VARS;
 +			FREE_BUFFERS();
 +			return false;
 +		}
          next_char = utf16_json[the_index];
  		if (next_char >= 128) {
  			next_class = C_ETC;
 @@ -540,6 +547,7 @@
                      }
                      key.len = 0;
                      buf.len = 0;
 +					++num_vars;
                      JSON_RESET_TYPE();
                  }
  
 @@ -561,6 +569,7 @@
                      json_create_zval(&mval, &buf, type);
                      add_next_index_zval(jp->the_zstack[jp->top], mval);
                      buf.len = 0;
 +					++num_vars;
                      JSON_RESET_TYPE();
                  }
  
 @@ -585,6 +594,7 @@
                      if (jp->top == 1) {
                          obj = z;
                    	} else {
 +					    ++num_vars;
                          ALLOC_INIT_ZVAL(obj);
                      }
  
 @@ -626,6 +636,7 @@
  
                      if (jp->top > 1) {
                          attach_zval(jp, jp->top - 1, jp->top, &key, assoc TSRMLS_CC);
 +				        ++num_vars;
                      }
  
                      JSON_RESET_TYPE();
 @@ -683,6 +694,7 @@
                                  } else {
                                      add_assoc_zval_ex(jp->the_zstack[jp->top], (key.len ? key.c : ""), (key.len ? (key.len + 1) : sizeof("")), mval);
                                  }
 +							    ++num_vars;
                                  key.len = 0;
                              }
                              jp->state = KE;
 @@ -691,6 +703,7 @@
                      case MODE_ARRAY:
                          if (type != -1) {
                              add_next_index_zval(jp->the_zstack[jp->top], mval);
 +							++num_vars;
                          }
                          jp->state = VA;
                          break;
 Index: branches/PHP_5_3/ext/json/php_json.h
 ===================================================================
 --- branches/PHP_5_3/ext/json/php_json.h	(revision 321767)
 +++ branches/PHP_5_3/ext/json/php_json.h	(working copy)
 @@ -48,7 +48,11 @@
  #endif
  
  PHP_JSON_API void php_json_encode(smart_str *buf, zval *val, int options TSRMLS_DC);
 -PHP_JSON_API void php_json_decode(zval *return_value, char *str, int str_len, zend_bool assoc, long depth TSRMLS_DC);
 +PHP_JSON_API void php_json_decode_ex(zval *return_value, char *str, int str_len, zend_bool assoc, long depth, long max_vars TSRMLS_DC);
 +static inline void php_json_decode(zval *return_value, char *str, int str_len, zend_bool assoc, long depth TSRMLS_DC)
 +{
 +	php_json_decode_ex(return_value, str, str_len, assoc, depth, 0 TSRMLS_CC);
 +}
  
  #define PHP_JSON_HEX_TAG	(1<<0)
  #define PHP_JSON_HEX_AMP	(1<<1)
 Index: branches/PHP_5_3/ext/json/JSON_parser.h
 ===================================================================
 --- branches/PHP_5_3/ext/json/JSON_parser.h	(revision 321767)
 +++ branches/PHP_5_3/ext/json/JSON_parser.h	(working copy)
 @@ -14,6 +14,7 @@
      int top;
  	int error_code;
      int* stack;
 +	long max_vars;
      zval **the_zstack;
      zval *the_static_zstack[JSON_PARSER_DEFAULT_DEPTH];
  } * JSON_parser;
 @@ -24,10 +25,11 @@
      PHP_JSON_ERROR_STATE_MISMATCH,  
      PHP_JSON_ERROR_CTRL_CHAR,   
      PHP_JSON_ERROR_SYNTAX,
 -    PHP_JSON_ERROR_UTF8
 +    PHP_JSON_ERROR_UTF8,
 +	PHP_JSON_ERROR_MAX_VARS
  };
  
 -extern JSON_parser new_JSON_parser(int depth);
 +extern JSON_parser new_JSON_parser(int depth, long max_vars);
  extern int parse_JSON(JSON_parser jp, zval *z, unsigned short utf16_json[], int length, int assoc TSRMLS_DC);
  extern int free_JSON_parser(JSON_parser jp);
  #endif
  Index: branches/PHP_5_3/main/rfc1867.c
  ===================================================================
  --- branches/PHP_5_3/main/rfc1867.c	(revision 321767)
  +++ branches/PHP_5_3/main/rfc1867.c	(working copy)