Code: static inline int add_post_vars(zval *arr, post_var_data_t *vars, zend_bool eof TSRMLS_DC)
{
	uint64_t max_vars = PG(max_input_vars);

	vars->ptr = vars->str.c;
	vars->end = vars->str.c + vars->str.len;
	while (add_post_var(arr, vars, eof TSRMLS_CC)) {
		if (++vars->cnt > max_vars) {
			php_error_docref(NULL TSRMLS_CC, E_WARNING,
					"Input variables exceeded %" PRIu64 ". "
					"To increase the limit change max_input_vars in php.ini.",
					max_vars);
			return FAILURE;
 		}
 	}
 
	if (!eof) {
 		memmove(vars->str.c, vars->ptr, vars->str.len = vars->end - vars->ptr);
 	}
 	return SUCCESS;
}

Vulnerability Type: DoS 
CWE ID: CWE-400
Summary: In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.
Commit Message: Fix bug #73807