php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #7198 crash due to bug/feature in mime.c see also BUGID#7179
Submitted: 2000-10-13 15:54 UTC Modified: 2000-10-16 21:33 UTC
From: liinu at uta dot fi Assigned:
Status: Closed Package: Reproducible Crash
PHP Version: 3.0.17 OS: Solaris 2.6
Private report: No CVE-ID: None
 [2000-10-13 15:54 UTC] liinu at uta dot fi
See also BUG#7179. This is addendum to that bug.

Here's gdb's back trace:
#0  0xef524734 in strlen ()
#1  0x55248 in php3_mime_split ()
#2  0x59f40 in php3_getpost ()
#3  0x5a554 in php3_treat_data ()
#4  0x2e1bc in _php3_hash_environment ()
#5  0x81974 in lex_scan ()
#6  0x3484c in read_next_token ()
#7  0x2cc4c in phplex ()
#8  0x7572c in phpparse ()
#9  0x2e698 in php3_parse ()
#10 0x2e9c0 in apache_php3_module_main ()
#11 0x2bcb8 in send_php3 ()
#12 0x2bd30 in send_parsed_php3 ()
#13 0x87770 in ap_invoke_handler ()
#14 0x98340 in process_request_internal ()
#15 0x98398 in ap_process_request ()
#16 0x911c8 in child_main ()
#17 0x91368 in make_child ()
#18 0x914b0 in startup_children ()
#19 0x91a5c in standalone_main ()

Something odd going on in functions/mime.c with php3 3.0.17. With some searching and trying various things this diff seems to fix/avoid this crash. This diff removes if(memcmp(...), which is causing the crash.test. In some ways revert back to way the functions/mime.c behaved in php3 3.0.16:
--- functions/mime.c.orig       Sun Sep 10 00:05:45 2000
+++ functions/mime.c    Fri Oct 13 22:51:01 2000
@@ -183,10 +183,8 @@
                                }
                                *(loc - 4) = '\0';
 
-                               /* Check to make sure we are not overwriting special file upload variables */
-                               if(memcmp(namebuf,sbuf,strlen(sbuf))) {
-                                       _php3_parse_gpc_data(ptr,namebuf,http_post_vars);
-                               }
+                               /* Magic function that figures everything out */
+                               _php3_parse_gpc_data(ptr,namebuf,http_post_vars);
 
                                /* And a little kludge to pick out special MAX_FILE_SIZE */
                                itype = php3_check_ident_type(namebuf);

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-10-16 21:33 UTC] sas@php.net
Fixed in CVS. Thanks for your report.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat May 11 12:01:33 2024 UTC