php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #3665 Simple bug in setCookie()
Submitted: 2000-02-29 09:00 UTC Modified: 2000-03-03 14:43 UTC
From: dk at dizain dot ru Assigned:
Status: Closed Package: Other
PHP Version: 3.0.15 OS: Win32, FreeBSD
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: dk at dizain dot ru
New email:
PHP Version: OS:

 

 [2000-02-29 09:00 UTC] dk at dizain dot ru
Dear PHP developers team! First, let me thank you for PHP processor - I think it's the best
server-sige language for CGI creation.

I have found a little bug in function SetCookie(). When
I use PHP command something like this:

  $TestCook=';;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;';  // 36 or more characters
  setCookie("TestCook",$TestCook,0x7FFFFFFF);

it fails with General Protection Fault. But if I use only 35 or less ";"s,
it works.

I think I know the root of this problem. Inside source file
"functions/head.c", in function _phps_SetCoolie we have:

  // file functions/head.c, line 462
  // len=0 first, name, value, etc. are the function parameters  (char*)
  if (name) len += strlen(name);
  if (value) len += strlen(value);
  if (path) len += strlen(path);
  if (domain) len += strlen(domain);
  tempstr = emalloc(len + 100);
  ........
  r = _php3_urlencode(value, strlen (value));
  sprintf(tempstr, "%s=%s", name, value ? r : "");  /// ?????!!!!!

When we use sprintf(tempstr,...) we will have the string bigger than
len+100 symbols (ya, every ";" character translates to "%XX", and
36*3 greater than 100).

To fix this problem, we can use following code:

  .......
  r = _php3_urlencode(value, strlen (value));
  efree(tempstr); tempstr=emalloc(strlen(r)+200);
  sprintf(tempstr, "%s=%s", name, value ? r : "");

Thanks before.
PS:
I'm sorry of my bad English...

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-03-03 14:43 UTC] sas at cvs dot php dot net
Thanks for your report. Release 3.0.15 contains the fix.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Sun Jul 06 09:01:32 2025 UTC