Arbitrarily limit array_pad() to only do 1 million elements at a time.

Probably still too high, but it solves the segfault for now.

Author: rlerdorf

TODO_SEGFAULTS

@@ -8,11 +8,10 @@ Fixed:
     socket_iovec_alloc (Rasmus)
 	exif_imagetype,exif_thumbnail (Rasmus)
     dbase_open (Rasmus)
-
+	array_pad (Rasmus)
 
 Open:
 
-    array_pad
     bcsub (1)
     mb_ereg (2)
     mb_ereg_match (2)

ext/standard/array.c

@@ -2339,6 +2339,10 @@ PHP_FUNCTION(array_pad)
 
 	/* Populate the pads array */
 	num_pads = pad_size_abs - input_size;
+	if(num_pads > 1048576) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "You may only pad up to 1048576 elements at a time");
+		RETURN_FALSE;
+	}
 	pads = (zval ***)emalloc(num_pads * sizeof(zval **));
 	for (i = 0; i < num_pads; i++)
 		pads[i] = pad_value;