php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #45540 stream_context_create creates bad http request
Submitted: 2008-07-17 07:10 UTC Modified: 2009-05-14 16:18 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: jdespatis at yahoo dot fr Assigned:
Status: Closed Package: Streams related
PHP Version: 5.2.6 OS: Linux Kubuntu
Private report: No CVE-ID:
 [2008-07-17 07:10 UTC] jdespatis at yahoo dot fr
Description:
------------
I'm coding a little script to upload a video on Youtube, thanks to stream functions in php.

It takes 2 steps:
1/ first connect on google to retrieve token, no problem with php code
2/ upload video with a query in POST, and there stream_context_create is giving a completely broken query.. From time to time, i can make it work, but it's pure random

I have used a sniffer as wireshark to see the exact http query

Reproduce code:
---------------
Here is the piece of code that does all this stuff:
http://www.despatis.com/php/bug.phps

Expected result:
----------------
PHP CLIENT => YOUTUBE SERVER:
POST /feeds/api/users/bigbluezen/uploads HTTP/1.0
Host: uploads.gdata.youtube.com
Content-Length: 792
Content-Type: multipart/related; boundary="---------------------------cefe168b3cb99683a0f9ebd6f9b2cca6"
Authorization: GoogleLogin auth=AIwbFAQtr5MDW_ctllHioiYCpY6I_uF6A9zBcSbIQ8AceGbcYfqrmytEICM8p6VjjzygDd2HPL0YhTcVk2MPmtb9y93-9Fs3yiej8hBtLF60_N_a6aWDg9Mrbm18nP-2dTVvTA6h77eJZrOJICzgN3dZyPT4AN1ffQ
X-GData-Client: ytapi-SourceRH-LaCartoonerie-3lludu8g-0
X-GData-Key: key=AI39si44WZavBNwYryVhVFaMH4Y8e0JbTAr83bScAxKby6LBW3xEyBzaXrV7MTw3sm56SmYVhSOWRXNfUrS0sqC1i7313ycFrQ
Slug: c447e7c1c0b79e8dc97c76cdc16e9843.gif

-----------------------------cefe168b3cb99683a0f9ebd6f9b2cca6
Content-Type: application/atom+xml; charset=UTF-8

<?xml version="1.0"?>
<entry xmlns="http://www.w3.org/2005/Atom" xmlns:media="http://search.yahoo.com/mrss/" xmlns:yt="http://gdata.youtube.com/schemas/2007">
  <media:group>
    <media:title type="plain">title foo</media:title>
    <media:description type="plain">description foo</media:description>
    <media:category scheme="http://gdata.youtube.com/schemas/2007/categories.cat">People</media:category>
    <media:keywords>key1, key2</media:keywords>
  </media:group>
</entry>

-----------------------------cefe168b3cb99683a0f9ebd6f9b2cca6
Content-Type: video/gif
Content-Transfer-Encoding: binary

XXX
-----------------------------cefe168b3cb99683a0f9ebd6f9b2cca6--

Actual result:
--------------
The actual result, found with a sniffer (wireshark for example) is:

PHP CLIENT => YOUTUBE SERVER:
POST /feeds/api/users/bigbluezen/uploads/wFqcFtuB9MY?client=ytapi-SourceRH-LaCartoonerie-3lludu8g-0 HTTP/1.0
Host: gdata.youtube.com
Authorization: GoogleLogin auth=AIwbFASurkAdrgigXGJeP24Ebc0dM7EierouUTZ7Nqm2pjSzo2aRtNXQgOo-_ebco_-w7CmpxcZqysZKS_UGCUSc-K6tD5NI84jIc7sf1Sq8cPtcbknOrvlqxF6PNBj-kLzeXEPnBwKoE4vJDuwE0ag7Aleyo-u3hw
X-GData-Client: ytapi-SourceRH-LaCartoonerie-3lludu8g-0
X-GData-Key: key=AI39si44WZavBNwYryVhVFaMH4Y8e0JbTAr83bScAxKby6LBW3xEyBzaXrV7MTw3sm56SmYVhSOWRXNfUrS0sqC1i7313ycFrQ
Slug: c447e7c1c0b79e8dc97c76cdc16e9843.gifbScAxKby6LBW3xEyBzaXrV7MTw3sm56SmYVhSOWRXNfUrS0sqC1i7313ycFrQ
Slug: c447e7c1c0b79e8dc97c76cdc16e9843.gif

EOF

As you can see, the first query is completely messy !!

The funny thing is that: if i change '<?xml version="1.0"?>' to '<xml version="1.0">' at line 64, the http query is good...

One could thing <? is interpreted by php, but in fact no... it also works if i keep the <? and ?> in the xml and change another things (add an echo somewhere, but this trick doesn't work all the time)

As the result is very random, i think file_get_contents doesn't get all data from the string, leaving some \r\n, which mess the following http query, maybe something like that...


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-07-17 07:14 UTC] jdespatis at yahoo dot fr
Oups, my script bug.php contains a function

To test it, one can use this simple script :
(no need to create a nothing.mp4 to use this example)

<?php
  include("bug.php");
  $params = array("username" => "bigbluezen", "password" => "demo", "title" => "ultimate video topmoumoute", "tags" => "test machin bidule", "channel" => "poetic");

  print_r(publish("nothing.mp4", $params));
?>
 [2008-07-17 22:46 UTC] jani@php.net
Are you sure this isn't same issue as reported in bug #43222 ?
What was the configure line you used to configure PHP?
Is short_open_tag enabled? Check from phpinfo()!
 [2008-07-18 08:44 UTC] jdespatis at yahoo dot fr
No this bug is different than bug 43222.
In the latter the post content seems to be good except a CRLF more which is not dramatic

In my case, the post content and header are completely broken...

I've modified my configuration to forbid short open tag
(i check with echo ini_get("short_open_tag") which returns nothing meaning false)

and i get the same bug.

But as I said, one could thing the bug comes from here (i've thought also), but not at all, the bug disappear if i let the short tag <? but change something else

Php behavior is really weird...
 [2008-07-18 12:23 UTC] jdespatis at yahoo dot fr
And to help to diagnose the problem

i can perfectly make this script work if I code the stream by my own for example, I replace stream_context_create by some code using fsockopen, all works perfectly ... (i really think stream_context_create leaves some \r \n in some special case ...)

$context = stream_context_create($opts);
$buff = @file_get_contents("http://uploads.gdata.youtube.com/feeds/api/users/$username/uploads", false, $context);

by

$fp = fsockopen("uploads.gdata.youtube.com", 80, $errno, $errstr, 30);
if (!$fp) {
  return "Youtube unreachable $errstr ($errno)";
}
$out  = "POST /feeds/api/users/$username/uploads HTTP/1.0\r\n";
$out .= "Host: uploads.gdata.youtube.com\r\n";
$out .= "Content-Length: " . strlen($opts["http"]["content"] ."\r\n";
$out .= "Connection: Close\r\n";
$out .= $opts["http"]["header"];
$out .= "\r\n";
$out .= $opts["http"]["content"];
fwrite($fp, $out);
$buff = "";
while (!feof($fp)) {
  $buff .= fgets($fp, 4096);
}
fclose($fp);
 [2008-07-18 16:05 UTC] jani@php.net
For the second time: What was the configure line you used to build PHP?
 [2008-07-18 16:45 UTC] jdespatis at yahoo dot fr
enzo@poseidon:~$ cat php-5.2.6/config.nice

#! /bin/sh
#
# Created by configure

'./configure' \
'--enable-sockets' \
'--enable-soap' \
'--with-mysql' \
'--enable-mbstring' \
'--enable-ftp' \
'--with-zlib' \
'--with-openssl' \
'--prefix=/home/enzo/divers/php_compil/' \
'--exec-prefix=/home/enzo/divers/php_compil/' \
'--disable-short-tags' \
"$@"
 [2008-07-20 11:10 UTC] jani@php.net
Ok. Now can you provide a proper self-contained reproducing script. One that starts with <?php, ends with ?> and can be run on the command line. ie. no POST required..
 [2008-07-27 08:37 UTC] jdespatis at yahoo dot fr
Well, i can give you a self-contained reproducing script:
http://www.despatis.com/php/stream.phps

But, it's impossible for me to avoid the use of POST, because this bug occurs on a http connection..

To run the bug, you just do in the command line (so using php cli):
$ php stream.php

I get the following result, you'll need a sniffer to see that data sent to http server is completely weird

token : AIwbFASbZooZXBAePnl4eayE1cZvRWbvOtzQTC-vRR-lkp1r3ijZ7AxoSIzuslTVmufPznylay34ryUPdLRMGh61cidHS29Z7NkKqLVYr2JdNY4iKN0qoVB2MSaV2rmumH_ZJTo3gp7Or0IJlaiMiNEs2R5aNllOYg
Array
(
    [type] => 2
    [message] => file_get_contents(http://uploads.gdata.youtube.com/feeds/api/users/bigbluezen/uploads): failed to open stream: HTTP request failed! HTTP/1.0 411 Length Required

    [file] => /home/enzo/projects/lacartoonerie/download/modules/stream.php
    [line] => 101
)
 [2008-07-28 19:11 UTC] lbarnaud@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

The server replies with a Location header, the HTTP wrapper automatically redirect, and that second request was effectively invalid (the request was sent as POST without Content-Length and post data).
 [2009-05-14 14:17 UTC] jani@php.net
Note: The fix was only applied to PHP_5_3 and HEAD branches, it's not 
(yet) in PHP_5_2 branch.
 [2009-05-14 16:18 UTC] lbarnaud@php.net
Now PHP_5_2 branch
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Wed Apr 16 19:02:26 2014 UTC