From d00bb3bad4329403d2210c9e47319dbff6ec75e7 Mon Sep 17 00:00:00 2001 From: Martin Mirchev Date: Tue, 27 Oct 2026 11:43:26 +0800 Subject: [PATCH] Fix urlencoded POST registering max_input_vars + 1 variables add_post_vars() checked the max_input_vars limit only after add_post_var() had already registered the variable, so an application/x-www-form-urlencoded body with more than max_input_vars variables produced max_input_vars + 1 entries in $_POST (1001 with the default setting). The GET, cookie and multipart/form-data paths stop at exactly max_input_vars. Skip registering the variable once the limit has been reached; the warning is emitted at the same point as before. --- main/php_variables.c | 9 +++++-- .../basic/max_input_vars_post_urlencoded.phpt | 24 +++++++++++++++++++ 2 files changed, 31 insertions(+), 2 deletions(-) create mode 100644 tests/basic/max_input_vars_post_urlencoded.phpt diff --git a/main/php_variables.c b/main/php_variables.c index 23fa3d6f5fe0..290b0825c4f4 100644 --- a/main/php_variables.c +++ b/main/php_variables.c @@ -346,7 +346,7 @@ typedef struct post_var_data { size_t already_scanned; } post_var_data_t; -static bool add_post_var(zval *arr, post_var_data_t *var, bool eof) +static bool add_post_var(zval *arr, post_var_data_t *var, bool eof, bool register_var) { char *start, *ksep, *vsep, *val; size_t klen, vlen; @@ -367,6 +367,11 @@ static bool add_post_var(zval *arr, post_var_data_t *var, bool eof) } } + if (!register_var) { + /* Over max_input_vars; the caller reports the error. */ + return 1; + } + ksep = memchr(var->ptr, '=', vsep - var->ptr); if (ksep) { *ksep = '\0'; @@ -411,7 +416,7 @@ static inline int add_post_vars(zval *arr, post_var_data_t *vars, bool eof) vars->ptr = ZSTR_VAL(vars->str.s); vars->end = ZSTR_VAL(vars->str.s) + ZSTR_LEN(vars->str.s); - while (add_post_var(arr, vars, eof)) { + while (add_post_var(arr, vars, eof, vars->cnt < max_vars)) { if (++vars->cnt > max_vars) { php_error_docref(NULL, E_WARNING, "Input variables exceeded %" PRIu64 ". " diff --git a/tests/basic/max_input_vars_post_urlencoded.phpt b/tests/basic/max_input_vars_post_urlencoded.phpt new file mode 100644 index 000000000000..357553d13931 --- /dev/null +++ b/tests/basic/max_input_vars_post_urlencoded.phpt @@ -0,0 +1,24 @@ +--TEST-- +max_input_vars limit for urlencoded POST data +--INI-- +max_input_vars=5 +--POST-- +a=1&b=2&c=3&d=4&e=5&f=6 +--FILE-- + +--EXPECT-- +Warning: PHP Request Startup: Input variables exceeded 5. To increase the limit change max_input_vars in php.ini. in Unknown on line 0 +array(5) { + ["a"]=> + string(1) "1" + ["b"]=> + string(1) "2" + ["c"]=> + string(1) "3" + ["d"]=> + string(1) "4" + ["e"]=> + string(1) "5" +}