php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #14201 Crash when uploading multiple files
Submitted: 2001-11-23 16:37 UTC Modified: 2001-11-23 17:05 UTC
From: djonexx at alpinet dot org Assigned:
Status: Closed Package: Reproducible crash
PHP Version: 4.0.6 OS: Windows 2000, Linux
Private report: No CVE-ID: None
 [2001-11-23 16:37 UTC] djonexx at alpinet dot org
When using a form to upload multiple files with the same name (example follows), there is a GPF in PHP4TS.DLL at address 0x005362EB. It is trying to read from address 0x00000001.
The PHP is 4.0.6 running on an Apache 1.3.20 server on Win2k sp2. The same problem manifests also on Linux 2.2.19.

Use a HTML page like this to upload files:
<form method="post" enctype="multipart/form-data" action="upload-test.php">
<input type="file" name="image[]"><input type="hidden" name="name[]">
...
<input type="file" name="image[]"><input type="hidden" name="name[]">
<input type="submit" value="Upload!">
</form>

--------
upload-test.php:
<?php echo sizeof($image); echo "<br>"; echo sizeof($name); ?>

--------

If there are more than N file fields, it will crash. On my machine N=26, even if the form is submitted empty.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-11-23 16:45 UTC] mfischer@php.net
file upload has been rewritten since then. 
Can you try latest RC if and see if it works?

Either

http://www.php.net/~zeev/php-4.1.0RC3.tar.gz

or

http://phpuk.org/~james/php-4.1.0RC3-win32.zip

Feedback.
 [2001-11-23 17:00 UTC] derick@php.net
These fixes will not be in the 4.1.0 release, try a snapshot (on linux) from snaps.php.net, or try a dev package (for windows) from www.php4win.com.

Please reopen if these versions didn't fix the problem.

Derick
 [2001-11-23 17:05 UTC] djonexx at alpinet dot org
It seems to work OK with the version 4.1.0 RC3 win2k. 
(from http://phpuk.org/~james/php-4.1.0RC3-win32.zip)

I have tested it with N=351.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Mon May 20 04:01:32 2024 UTC