Description:
------------
Fuzz testing revealed that this multipart request is parsed differently, depending on the number of 'a' characters:

--BOUNDARY
Content-Disposition: form-data; name="test"; aaaaaaaaa...aaaaaaaaaa:; filename="test.txt"

This is a test
--BOUNDARY--

For up to 5074 'a' characters, PHP parses this as a file upload: _FILES["test"] contains an array.

For 5075 'a' characters and more, PHP parses this as a POST parameter: _POST["test"] contains the string "This is a test".


This is very strange behavior. I expect that PHP parses these requests the same way, regardless of the number of 'a' characters.

Test script:
---------------
#!/bin/bash
(
	printf -- "--BOUNDARY\r\n"
	printf -- "Content-Disposition: form-data; name=\"test\"; "
	printf -- "a%.0s" {1..5074}
	printf -- ":; filename=\"test.txt\"\r\n"
	printf -- "\r\n"
	printf -- "This is a test\r\n"
	printf -- "--BOUNDARY--"
) > /tmp/test.dat

curl -H "Content-Type: multipart/form-data; boundary=BOUNDARY" --data-binary @/tmp/test.dat http://.../phpinfo.php