php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #7198 crash due to bug/feature in mime.c see also BUGID#7179
Submitted: 2000-10-13 15:54 UTC Modified: 2000-10-16 21:33 UTC
From: liinu at uta dot fi Assigned:
Status: Closed Package: Reproducible Crash
PHP Version: 3.0.17 OS: Solaris 2.6
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: liinu at uta dot fi
New email:
PHP Version: OS:

 

 [2000-10-13 15:54 UTC] liinu at uta dot fi
See also BUG#7179. This is addendum to that bug.

Here's gdb's back trace:
#0  0xef524734 in strlen ()
#1  0x55248 in php3_mime_split ()
#2  0x59f40 in php3_getpost ()
#3  0x5a554 in php3_treat_data ()
#4  0x2e1bc in _php3_hash_environment ()
#5  0x81974 in lex_scan ()
#6  0x3484c in read_next_token ()
#7  0x2cc4c in phplex ()
#8  0x7572c in phpparse ()
#9  0x2e698 in php3_parse ()
#10 0x2e9c0 in apache_php3_module_main ()
#11 0x2bcb8 in send_php3 ()
#12 0x2bd30 in send_parsed_php3 ()
#13 0x87770 in ap_invoke_handler ()
#14 0x98340 in process_request_internal ()
#15 0x98398 in ap_process_request ()
#16 0x911c8 in child_main ()
#17 0x91368 in make_child ()
#18 0x914b0 in startup_children ()
#19 0x91a5c in standalone_main ()

Something odd going on in functions/mime.c with php3 3.0.17. With some searching and trying various things this diff seems to fix/avoid this crash. This diff removes if(memcmp(...), which is causing the crash.test. In some ways revert back to way the functions/mime.c behaved in php3 3.0.16:
--- functions/mime.c.orig       Sun Sep 10 00:05:45 2000
+++ functions/mime.c    Fri Oct 13 22:51:01 2000
@@ -183,10 +183,8 @@
                                }
                                *(loc - 4) = '\0';
 
-                               /* Check to make sure we are not overwriting special file upload variables */
-                               if(memcmp(namebuf,sbuf,strlen(sbuf))) {
-                                       _php3_parse_gpc_data(ptr,namebuf,http_post_vars);
-                               }
+                               /* Magic function that figures everything out */
+                               _php3_parse_gpc_data(ptr,namebuf,http_post_vars);
 
                                /* And a little kludge to pick out special MAX_FILE_SIZE */
                                itype = php3_check_ident_type(namebuf);

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-10-16 21:33 UTC] sas@php.net
Fixed in CVS. Thanks for your report.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Thu Jul 03 10:01:33 2025 UTC