php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #8078 File upload causes memory corruption / sig11 in rfc1867.c
Submitted: 2000-12-02 09:44 UTC Modified: 2000-12-20 05:50 UTC
From: mb at sime dot com Assigned:
Status: Closed Package: Reproducible Crash
PHP Version: 4.0.3pl1 OS: Linux 2.2.17
Private report: No CVE-ID: None
View Add Comment Developer Edit
 [2000-12-02 09:44 UTC] mb at sime dot com 
When receiving posted data with enctype="multipart/form-data" php exits with sig11; after compiling php to run as cgi with debug information I get the following error message:

[Fri Dec  1 15:22:48 2000]  Script:  '/home/httpd/login/htdocs/intranet/arch/save_dok.php'
---------------------------------------
rfc1867.c(182) : Block 0x081DD568 status:
Beginning:      OK (allocated on rfc1867.c:184, 16 bytes)
      End:      Overflown (magic=0x2A8FCC00 instead of 0x2A8FCC84)
                1 byte(s) overflown
---------------------------------------

Looks like there's something wrong with the decoder for multipart-formdata.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-12-03 00:04 UTC] sniper@php.net 
Please check if this happens with the PHP4.0.4RC3:
http://www.php.net/distributions/php-4.0.4RC3.tar.gz

--Jani
 [2000-12-03 11:36 UTC] mb at sime dot com 
Error occurs when using 4.0.4RC3 as well:

[Sun Dec  3 17:23:59 2000]  Script:  '-'
---------------------------------------
rfc1867.c(183) : Block 0x0818BAD8 status:
Beginning:      OK (allocated on rfc1867.c:185, 16 bytes)
      End:      Overflown (magic=0x2A8FCC00 instead of 0x2A8FCC84)
                1 byte(s) overflown

You can find the page I'm submiting on http://mabene.sime.com/edit_dokument.htm. just submitting this to a dummy-script (something like 
<? phpinfo(); ?>
will give you 6 of the messages above.

configure: 
./configure  \
 --enable-debug \
 --enable-track-vars \
 --with-config-file-path=/etc/ \
 --enable-trans-sid \
 --enable-discard-path \
 --without-msql \
 --without-mysql \
 --enable-force-cgi-redirect
 [2000-12-20 05:50 UTC] mb at sime dot com 
Problem fixed by changing main/rfc1867.c from
    lbuf = emalloc(s-name + MAX_SIZE_OF_INDEX);
to
    lbuf = emalloc(s-name + MAX_SIZE_OF_INDEX+1);

Fix is included in php 4.0.4 release.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Mon May 20 03:01:32 2024 UTC