php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #3665 Simple bug in setCookie()
Submitted: 2000-02-29 09:00 UTC Modified: 2000-03-03 14:43 UTC
From: dk at dizain dot ru Assigned:
Status: Closed Package: Other
PHP Version: 3.0.15 OS: Win32, FreeBSD
Private report: No CVE-ID: None
 [2000-02-29 09:00 UTC] dk at dizain dot ru
Dear PHP developers team! First, let me thank you for PHP processor - I think it's the best
server-sige language for CGI creation.

I have found a little bug in function SetCookie(). When
I use PHP command something like this:

  $TestCook=';;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;';  // 36 or more characters
  setCookie("TestCook",$TestCook,0x7FFFFFFF);

it fails with General Protection Fault. But if I use only 35 or less ";"s,
it works.

I think I know the root of this problem. Inside source file
"functions/head.c", in function _phps_SetCoolie we have:

  // file functions/head.c, line 462
  // len=0 first, name, value, etc. are the function parameters  (char*)
  if (name) len += strlen(name);
  if (value) len += strlen(value);
  if (path) len += strlen(path);
  if (domain) len += strlen(domain);
  tempstr = emalloc(len + 100);
  ........
  r = _php3_urlencode(value, strlen (value));
  sprintf(tempstr, "%s=%s", name, value ? r : "");  /// ?????!!!!!

When we use sprintf(tempstr,...) we will have the string bigger than
len+100 symbols (ya, every ";" character translates to "%XX", and
36*3 greater than 100).

To fix this problem, we can use following code:

  .......
  r = _php3_urlencode(value, strlen (value));
  efree(tempstr); tempstr=emalloc(strlen(r)+200);
  sprintf(tempstr, "%s=%s", name, value ? r : "");

Thanks before.
PS:
I'm sorry of my bad English...

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-03-03 14:43 UTC] sas at cvs dot php dot net
Thanks for your report. Release 3.0.15 contains the fix.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri May 10 12:01:32 2024 UTC