Check for exceeding array size limits

TysonAndre · TysonAndre · commit d395cdb85954 · 2022-02-13T07:53:32.000-05:00
diff --git a/ext/collections/collections_deque.c b/ext/collections/collections_deque.c
@@ -767,6 +767,11 @@ PHP_METHOD(Collections_Deque, toArray)
 	if (!len) {
 		RETURN_EMPTY_ARRAY();
 	}
+	if (UNEXPECTED(len >= HT_MAX_SIZE)) {
+		/* This would take 32GB of memory in 64-bit builds and 1GB in 32-bit builds. (16 bytes per zval) */
+		zend_throw_exception(spl_ce_RuntimeException, "Cannot convert Deque to an array, this exceeds the maximum array size", 0);
+		RETURN_THROWS();
+	}
 	RETURN_ARR(collections_deque_to_new_array(&intern->array));
 }
 

Original file line number	Diff line number	Diff line change
`@@ -767,6 +767,11 @@ PHP_METHOD(Collections_Deque, toArray)`
`767`	`767`	`if (!len) {`
`768`	`768`	`RETURN_EMPTY_ARRAY();`
`769`	`769`	`}`
	`770`	`+ if (UNEXPECTED(len >= HT_MAX_SIZE)) {`
	`771`	`+ /* This would take 32GB of memory in 64-bit builds and 1GB in 32-bit builds. (16 bytes per zval) */`
	`772`	`+ zend_throw_exception(spl_ce_RuntimeException, "Cannot convert Deque to an array, this exceeds the maximum array size", 0);`
	`773`	`+ RETURN_THROWS();`
	`774`	`+ }`
`770`	`775`	`RETURN_ARR(collections_deque_to_new_array(&intern->array));`
`771`	`776`	`}`
`772`	`777`