From ff1016e504770dd334ab30fa85de11e8559eee01 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Fri, 22 Jul 2016 15:57:20 +0200
Subject: [PATCH] Limit maximal numver of fields to 4096
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 libraries/create_addfield.lib.php | 9 ++++++---
 normalization.php                 | 2 +-
 tbl_addfield.php                  | 7 +++++--
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/libraries/create_addfield.lib.php b/libraries/create_addfield.lib.php
index 04820e8760..aeccf09c32 100644
--- a/libraries/create_addfield.lib.php
+++ b/libraries/create_addfield.lib.php
@@ -445,13 +445,16 @@ function PMA_getTableCreationQuery($db, $table)
 function PMA_getNumberOfFieldsFromRequest()
 {
     if (isset($_REQUEST['submit_num_fields'])) { // adding new fields
-        $num_fields = $_REQUEST['orig_num_fields'] + $_REQUEST['added_fields'];
+        $num_fields = min(
+            4096,
+            intval($_REQUEST['orig_num_fields']) + intval($_REQUEST['added_fields'])
+        );
     } elseif (isset($_REQUEST['orig_num_fields'])) { // retaining existing fields
-        $num_fields = $_REQUEST['orig_num_fields'];
+        $num_fields = min(4096, intval($_REQUEST['orig_num_fields']));
     } elseif (isset($_REQUEST['num_fields'])
         && intval($_REQUEST['num_fields']) > 0
     ) { // new table with specified number of fields
-        $num_fields = (int) $_REQUEST['num_fields'];
+        $num_fields = min(4096, intval($_REQUEST['num_fields']));
     } else { // new table with unspecified number of fields
         $num_fields = 4;
     }
diff --git a/normalization.php b/normalization.php
index 8ebbf4244b..30003b8591 100644
--- a/normalization.php
+++ b/normalization.php
@@ -26,7 +26,7 @@ if (isset($_REQUEST['getColumns'])) {
     exit;
 }
 if (isset($_REQUEST['splitColumn'])) {
-    $num_fields = $_REQUEST['numFields'];
+    $num_fields = min(4096, intval($_REQUEST['numFields']));
     $html = PMA_getHtmlForCreateNewColumn($num_fields, $db, $table);
     $html .= PMA_URL_getHiddenInputs($db, $table);
     echo $html;
diff --git a/tbl_addfield.php b/tbl_addfield.php
index 18455dc899..90424f57f2 100644
--- a/tbl_addfield.php
+++ b/tbl_addfield.php
@@ -42,10 +42,13 @@ if (isset($_REQUEST['submit_num_fields'])) {
     if (isset($_REQUEST['orig_field_where'])) {
         $_REQUEST['field_where'] = $_REQUEST['orig_field_where'];
     }
-    $num_fields = $_REQUEST['orig_num_fields'] + $_REQUEST['added_fields'];
+    $num_fields = min(
+        intval($_REQUEST['orig_num_fields']) + intval($_REQUEST['added_fields']),
+        4096
+    );
     $regenerate = true;
 } elseif (isset($_REQUEST['num_fields']) && intval($_REQUEST['num_fields']) > 0) {
-    $num_fields = (int) $_REQUEST['num_fields'];
+    $num_fields = min(4096, intval($_REQUEST['num_fields']));
 } else {
     $num_fields = 1;
 }