[php-src] PR #24773: Fix urlencoded POST registering max_input_vars + 1 variables
| From: | Marti2203 | Date: | Tue, 27 Oct 2026 03:45:06 +0000 |
| Subject: | [php-src] PR #24773: Fix urlencoded POST registering max_input_vars + 1 variables | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39948@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24773
Author: Marti2203
An
application/x-www-form-urlencoded POST body with more than
max_input_vars variables puts max_input_vars + 1 entries into
$_POST. GET, cookies and multipart/form-data stop at exactly
max_input_vars.
### Reproducer
php-cgi, max_input_vars=1000, with 1001 variables each in the query string, the
Cookie header and the urlencoded body:
```
$ php-cgi -n -d max_input_vars=1000 -d output_buffering=4096 count.php # count.php: echo
count($_GET), count($_POST), count($_COOKIE)
Warning: PHP Request Startup: Input variables exceeded 1000. ... (x3)
GET=1000 POST=1001 COOKIE=1000
```
The same count shows up in #20456 ("Total test values: 1001").
### Cause
add_post_vars() checks the limit only after add_post_var() has already
registered the variable:
```c
while (add_post_var(arr, vars, eof)) {
if (++vars->cnt > max_vars) {
/* warning */
return FAILURE;
}
```
php_default_treat_data() (GET/cookies) and rfc1867.c check the count
before registering.
### Fix
add_post_vars() passes vars->cnt < max_vars to
add_post_var(). Once the limit has been reached, add_post_var() still
reports that a variable is present but does not register it. The warning text and the point where
parsing stops do not change. With the fix the output above becomes GET=1000 POST=1000
COOKIE=1000. A body of exactly 1000 variables still gives 1000 entries and no warning, and
max_input_vars=0 now gives 0 entries for POST, as it already did for GET.
### Tests
- New tests/basic/max_input_vars_post_urlencoded.phpt (max_input_vars=5, 6
POST variables): before the fix $_POST has 6 entries and the test fails; with the fix
it has 5 and the test passes.
- tests/basic, ext/standard/tests/http (including
request_parse_body), sapi/cgi/tests, sapi/cli/tests: 277
passed, 68 skipped, 0 failed. Zend/tests/oom_request_parsing.phpt also passes.
(Non-debug --disable-all --enable-cli --enable-cgi build.)
This issue was found by an LLM-Enhanced Static Analysis Engine and verified manually.