[php-src] PR #24773: Fix urlencoded POST registering max_input_vars + 1 variables

From: Date: Tue, 27 Oct 2026 03:45:06 +0000
Subject: [php-src] PR #24773: Fix urlencoded POST registering max_input_vars + 1 variables
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39948@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24773 Author: Marti2203 An application/x-www-form-urlencoded POST body with more than max_input_vars variables puts max_input_vars + 1 entries into $_POST. GET, cookies and multipart/form-data stop at exactly max_input_vars. ### Reproducer php-cgi, max_input_vars=1000, with 1001 variables each in the query string, the Cookie header and the urlencoded body: ``` $ php-cgi -n -d max_input_vars=1000 -d output_buffering=4096 count.php # count.php: echo count($_GET), count($_POST), count($_COOKIE) Warning: PHP Request Startup: Input variables exceeded 1000. ... (x3) GET=1000 POST=1001 COOKIE=1000 ``` The same count shows up in #20456 ("Total test values: 1001"). ### Cause add_post_vars() checks the limit only after add_post_var() has already registered the variable: ```c while (add_post_var(arr, vars, eof)) { if (++vars->cnt > max_vars) { /* warning */ return FAILURE; } ``` php_default_treat_data() (GET/cookies) and rfc1867.c check the count before registering. ### Fix add_post_vars() passes vars->cnt < max_vars to add_post_var(). Once the limit has been reached, add_post_var() still reports that a variable is present but does not register it. The warning text and the point where parsing stops do not change. With the fix the output above becomes GET=1000 POST=1000 COOKIE=1000. A body of exactly 1000 variables still gives 1000 entries and no warning, and max_input_vars=0 now gives 0 entries for POST, as it already did for GET. ### Tests - New tests/basic/max_input_vars_post_urlencoded.phpt (max_input_vars=5, 6 POST variables): before the fix $_POST has 6 entries and the test fails; with the fix it has 5 and the test passes. - tests/basic, ext/standard/tests/http (including request_parse_body), sapi/cgi/tests, sapi/cli/tests: 277 passed, 68 skipped, 0 failed. Zend/tests/oom_request_parsing.phpt also passes. (Non-debug --disable-all --enable-cli --enable-cgi build.) This issue was found by an LLM-Enhanced Static Analysis Engine and verified manually.

« previous php.git-pulls (#39948) next »