Description:
------------
It is possible to supply a filename which will be incorrectly parsed by PHP. The problem occurs when uploading a file from an HTML form with attributes name="file[" (lacking the closing bracket) and type="file". I'm using Apache 2.2.14 & PHP 5.3.1, but I was able to reproduce the bug with Apache 2.2.10 & PHP 5.3.0.


Reproduce code:
---------------
HTML form - form.html:

<form method="post" enctype="multipart/form-data" action="upload.php">
<input type="file" name="file[" />
<input type="submit" value="OK" />
</form>


PHP code - upload.php:

<?php
var_dump($_FILES);
?>


The body of the HTTP request:

------------3PL7QzumhbsotvnG6nZnmR
Content-Disposition: form-data; name="file["; filename="code.gif"
Content-Type: image/gif

<binary gif data>

------------3PL7QzumhbsotvnG6nZnmR--


Expected result:
----------------
The array $_FILES should contain valid keys as specified in http://www.php.net/manual/en/features.file-upload.post-method.php. Hovever, the following assertion fails:

if (isset($_FILES["file"])) {
    assert(is_string($_FILES["name"])); // actual key is "[name"
}

Since the filename ("file[") lacks the closing bracket, it probably should be interpreted as a single file named "file[":

array(1) { ["file["]=> array(5) { ["name"]=> string(8) "code.gif" ["type"]=> string(9) "image/gif" ["tmp_name"]=> string(17) "C:\Temp\php3A.tmp" ["error"]=> int(0) ["size"]=> int(3342) } }


Actual result:
--------------
The array $_FILES:

array(1) { ["file"]=> array(5) { ["[name"]=> string(8) "code.gif" ["[type"]=> string(9) "image/gif" ["[tmp_name"]=> string(17) "C:\Temp\php3A.tmp" ["[error"]=> int(0) ["[size"]=> int(3342) } }