diff --git a/ext/standard/array.c b/ext/standard/array.c index 96a32da8e0552..c8afc08cffa62 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -4344,13 +4344,14 @@ PHP_FUNCTION(array_pad) Z_PARAM_ZVAL(pad_value) ZEND_PARSE_PARAMETERS_END(); + if (pad_size < Z_L(-HT_MAX_SIZE) || pad_size > Z_L(HT_MAX_SIZE)) { + zend_argument_value_error(2, "must not exceed the maximum allowed array size"); + RETURN_THROWS(); + } + /* Do some initial calculations */ input_size = zend_hash_num_elements(Z_ARRVAL_P(input)); pad_size_abs = ZEND_ABS(pad_size); - if (pad_size_abs < 0 || pad_size_abs - input_size > Z_L(1048576)) { - zend_argument_value_error(2, "must be less than or equal to 1048576"); - RETURN_THROWS(); - } if (input_size >= pad_size_abs) { /* Copy the original array */ diff --git a/ext/standard/tests/array/array_pad.phpt b/ext/standard/tests/array/array_pad.phpt index 5abcbac87ef7d..67cb423497ffb 100644 --- a/ext/standard/tests/array/array_pad.phpt +++ b/ext/standard/tests/array/array_pad.phpt @@ -13,12 +13,6 @@ var_dump(array_pad(array("", -1, 2.0), 2, array())); var_dump(array_pad(array("", -1, 2.0), -3, array())); var_dump(array_pad(array("", -1, 2.0), -4, array())); -try { - var_dump(array_pad(array("", -1, 2.0), 2000000, 0)); -} catch (\ValueError $e) { - echo $e->getMessage() . "\n"; -} - ?> --EXPECT-- array(1) { @@ -84,4 +78,3 @@ array(4) { [3]=> float(2) } -array_pad(): Argument #2 ($length) must be less than or equal to 1048576 diff --git a/ext/standard/tests/array/array_pad_too_large_padding.phpt b/ext/standard/tests/array/array_pad_too_large_padding.phpt new file mode 100644 index 0000000000000..3a45e834f9a01 --- /dev/null +++ b/ext/standard/tests/array/array_pad_too_large_padding.phpt @@ -0,0 +1,20 @@ +--TEST-- +array_pad() with too large padding should fail +--FILE-- +getMessage() . "\n"; + } +} + +test(PHP_INT_MIN); +test(PHP_INT_MAX); + +?> +--EXPECT-- +array_pad(): Argument #2 ($length) must not exceed the maximum allowed array size +array_pad(): Argument #2 ($length) must not exceed the maximum allowed array size