php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add array size maximum to array_diff()

Browse Source 
This silences some reports about the equivalence to array_merge()'s
issue. However, this is different as no packed fill is used in this
code, so it doesn't have the same bug that array_merge() had.

Closes GH-21449.
This commit is contained in:
ndossche
2026-03-15 00:30:00 +01:00
parent 30b2d77cd3
commit 614b22ab46
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@@ -134,6 +134,7 @@ PHP NEWS
null destination). (David Carlier) null destination). (David Carlier)
. Fixed bug GH-13204 (glob() fails if square bracket is in current directory). . Fixed bug GH-13204 (glob() fails if square bracket is in current directory).
(ndossche) (ndossche)
. Add array size maximum to array_diff(). (ndossche)
- Streams: - Streams:
. Added so_keepalive, tcp_keepidle, tcp_keepintvl and tcp_keepcnt stream . Added so_keepalive, tcp_keepidle, tcp_keepintvl and tcp_keepcnt stream

7
ext/standard/array.c
View File

@@ -5741,7 +5741,7 @@ PHP_FUNCTION(array_diff)
{ {
zval *args; zval *args;
uint32_t argc, i; uint32_t argc, i;
uint32_t num; uint64_t num;
HashTable exclude; HashTable exclude;
zval *value; zval *value;
zend_string *str, *tmp_str, *key; zend_string *str, *tmp_str, *key;
@@ -5831,6 +5831,11 @@ PHP_FUNCTION(array_diff)
return; return;
} }
if (UNEXPECTED(num >= HT_MAX_SIZE)) {
zend_throw_error(NULL, "The total number of elements must be lower than %u", HT_MAX_SIZE);
RETURN_THROWS();
}
ZVAL_NULL(&dummy); ZVAL_NULL(&dummy);
/* create exclude map */ /* create exclude map */
zend_hash_init(&exclude, num, NULL, NULL, 0); zend_hash_init(&exclude, num, NULL, NULL, 0);