Patch for CVE-2011-4885

php5-CVE-2011-4885.patch

--- A/main/php_variables.c      2011/12/22 13:28:01     321334
+++ B/main/php_variables.c      2011/12/22 15:31:41     321335
@@ -191,9 +191,14 @@
                                }
                                if (zend_symtable_find(symtable1, escaped_index, index_len + 1, (void **) &gpc_element_p) == FAILURE
                                        || Z_TYPE_PP(gpc_element_p) != IS_ARRAY) {
+                                       if (zend_hash_num_elements(symtable1) <= PG(max_input_vars)) {
+                                               if (zend_hash_num_elements(symtable1) == PG(max_input_vars)) {
+                                                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars));
+                                               }
+                                               MAKE_STD_ZVAL(gpc_element);
+                                               array_init(gpc_element);
+                                               zend_symtable_update(symtable1, escaped_index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
+                                       }
-                                       MAKE_STD_ZVAL(gpc_element);
-                                       array_init(gpc_element);
-                                       zend_symtable_update(symtable1, escaped_index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
                                }
                                if (index != escaped_index) {
                                        efree(escaped_index);
@@ -236,7 +241,14 @@
                                zend_symtable_exists(symtable1, escaped_index, index_len + 1)) {
                                zval_ptr_dtor(&gpc_element);
                        } else {
+                               if (zend_hash_num_elements(symtable1) <= PG(max_input_vars)) {
+                                       if (zend_hash_num_elements(symtable1) == PG(max_input_vars)) {
+                                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars));
+                                       }
+                                       zend_symtable_update(symtable1, escaped_index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
+                               } else {
+                                       zval_ptr_dtor(&gpc_element);
+                               }
-                               zend_symtable_update(symtable1, escaped_index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
                        }
                        if (escaped_index != index) {
                                efree(escaped_index);
--- A/main/main.c       2011/12/15 07:28:28     321037
+++ B/main/main.c       2011/12/15 08:47:03     321038
@@ -496,6 +496,7 @@
        STD_PHP_INI_ENTRY("post_max_size",                      "8M",           PHP_INI_SYSTEM|PHP_INI_PERDIR,          OnUpdateLong,                   post_max_size,                  sapi_globals_struct,sapi_globals)
        STD_PHP_INI_ENTRY("upload_tmp_dir",                     NULL,           PHP_INI_SYSTEM,         OnUpdateStringUnempty,  upload_tmp_dir,                 php_core_globals,       core_globals)
        STD_PHP_INI_ENTRY("max_input_nesting_level", "64",              PHP_INI_SYSTEM|PHP_INI_PERDIR,          OnUpdateLongGEZero,     max_input_nesting_level,                        php_core_globals,       core_globals)
+       STD_PHP_INI_ENTRY("max_input_vars",                     "1000",         PHP_INI_SYSTEM|PHP_INI_PERDIR,          OnUpdateLongGEZero,     max_input_vars,                                         php_core_globals,

        STD_PHP_INI_ENTRY("user_dir",                           NULL,           PHP_INI_SYSTEM,         OnUpdateString,                 user_dir,                               php_core_globals,       core_globals)
        STD_PHP_INI_ENTRY("variables_order",            "EGPCS",        PHP_INI_SYSTEM|PHP_INI_PERDIR,          OnUpdateStringUnempty,  variables_order,                php_core_globals,       core_globals)
--- A/main/php_globals.h        2011/12/15 07:28:28     321037
+++ B/main/php_globals.h        2011/12/15 08:47:03     321038
@@ -172,6 +172,8 @@
        zend_bool in_error_log;
+
+       long max_input_vars;
 };