php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #8078 File upload causes memory corruption / sig11 in rfc1867.c
Submitted: 2000-12-02 09:44 UTC Modified: 2000-12-20 05:50 UTC
From: mb at sime dot com Assigned:
Status: Closed Package: Reproducible Crash
PHP Version: 4.0.3pl1 OS: Linux 2.2.17
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: mb at sime dot com
New email:
PHP Version: OS:

 

 [2000-12-02 09:44 UTC] mb at sime dot com 
When receiving posted data with enctype="multipart/form-data" php exits with sig11; after compiling php to run as cgi with debug information I get the following error message:

[Fri Dec  1 15:22:48 2000]  Script:  '/home/httpd/login/htdocs/intranet/arch/save_dok.php'
---------------------------------------
rfc1867.c(182) : Block 0x081DD568 status:
Beginning:      OK (allocated on rfc1867.c:184, 16 bytes)
      End:      Overflown (magic=0x2A8FCC00 instead of 0x2A8FCC84)
                1 byte(s) overflown
---------------------------------------

Looks like there's something wrong with the decoder for multipart-formdata.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-12-03 00:04 UTC] sniper@php.net 
Please check if this happens with the PHP4.0.4RC3:
http://www.php.net/distributions/php-4.0.4RC3.tar.gz

--Jani
 [2000-12-03 11:36 UTC] mb at sime dot com 
Error occurs when using 4.0.4RC3 as well:

[Sun Dec  3 17:23:59 2000]  Script:  '-'
---------------------------------------
rfc1867.c(183) : Block 0x0818BAD8 status:
Beginning:      OK (allocated on rfc1867.c:185, 16 bytes)
      End:      Overflown (magic=0x2A8FCC00 instead of 0x2A8FCC84)
                1 byte(s) overflown

You can find the page I'm submiting on http://mabene.sime.com/edit_dokument.htm. just submitting this to a dummy-script (something like 
<? phpinfo(); ?>
will give you 6 of the messages above.

configure: 
./configure  \
 --enable-debug \
 --enable-track-vars \
 --with-config-file-path=/etc/ \
 --enable-trans-sid \
 --enable-discard-path \
 --without-msql \
 --without-mysql \
 --enable-force-cgi-redirect
 [2000-12-20 05:50 UTC] mb at sime dot com 
Problem fixed by changing main/rfc1867.c from
    lbuf = emalloc(s-name + MAX_SIZE_OF_INDEX);
to
    lbuf = emalloc(s-name + MAX_SIZE_OF_INDEX+1);

Fix is included in php 4.0.4 release.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sun Jul 13 02:01:32 2025 UTC