php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #7753 Segmentation violation in functions/mime.c
Submitted: 2000-11-10 14:50 UTC Modified: 2002-06-16 08:22 UTC
From: mills at cc dot umanitoba dot ca Assigned:
Status: Not a bug Package: Reproducible Crash
PHP Version: 3.0.17 OS: Solaris 2.6
Private report: No CVE-ID: None
 [2000-11-10 14:50 UTC] mills at cc dot umanitoba dot ca
With the following mime headers posted from the Silkymail
compose screen:

Content-type: multipart/form-data; boundary=---------------------------21140735331682
Content-Length: 714
-----------------------------21140735331682
Content-Disposition: form-data; name="actionID"
-----------------------------21140735331682
Content-Disposition: form-data; name="copyto"
-----------------------------21140735331682
Content-Disposition: form-data; name="to"
-----------------------------21140735331682
Content-Disposition: form-data; name="cc"
-----------------------------21140735331682
Content-Disposition: form-data; name="bcc"
-----------------------------21140735331682
Content-Disposition: form-data; name="subject"
-----------------------------21140735331682
Content-Disposition: form-data; name="message"
-----------------------------21140735331682--

apache gets a segmentation violation.  Here is a library
call trace:

    -> libc:strncmp(0x13e0a3, 0xefffe354, 0x28, 0x2d)
    <- libc:strncmp() = -6
    -> libc:memchr(0x13e0a4, 0x2d, 0x25e, 0x35393632)
    <- libc:memchr() = 0x13e0a4
    -> libc:strncmp(0x13e0a4, 0xefffe354, 0x28, 0x2d)
    <- libc:strncmp() = -6
    -> libc:memchr(0x13e0a5, 0x2d, 0x25d, 0x0)
    <- libc:memchr() = 0x13e0a5
    -> libc:strncmp(0x13e0a5, 0xefffe354, 0x28, 0x2d)
    <- libc:strncmp() = 0
    -> libc:strlen(0x0, 0xefffe37c, 0xffffffff, 0x31343034)
    Incurred fault #6, FLTBOUNDS  %pc = 0xEF6329EC
      siginfo: SIGSEGV SEGV_MAPERR addr=0x00000000
    Received signal #11, SIGSEGV [default]
      siginfo: SIGSEGV SEGV_MAPERR addr=0x00000000
        *** process killed ***

This is because `sbuf' is NULL.  The following patchs fixes it,
although I don't know that the logic is correct:

*** mime.Oc     Sat Sep  9 16:05:45 2000
--- mime.c      Thu Nov  9 20:49:12 2000
***************
*** 184,190 ****
                                *(loc - 4) = '\0';
  
                                /* Check to make sure we are not overwriting special file upload variables */
!                               if(memcmp(namebuf,sbuf,strlen(sbuf))) {
                                        _php3_parse_gpc_data(ptr,namebuf,http_post_vars);
                                }
  
--- 184,190 ----
                                *(loc - 4) = '\0';
  
                                /* Check to make sure we are not overwriting special file upload variables */
!                               if(sbuf && memcmp(namebuf,sbuf,strlen(sbuf))) {
                                        _php3_parse_gpc_data(ptr,namebuf,http_post_vars);
                                }
  

php is built this way:
env CC=cc \
        ./configure \
        --with-db2=/usr/local/src/db/db-2.4.14/Unix \
        --with-apxs=/usr/local/apache/sbin/apxs \
        --with-ldap=/usr/local/src/ldap/openldap-1.2.11 \
        --with-imap=/usr/local/src/c-client/imap-2000 \
        --with-imsp=/usr/local/src/c-client/libimsp \
        --with-mysql=/usr/local/src/mysql/mysql-3.22.32



Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-06-16 08:22 UTC] sander@php.net
Thank you for taking the time to report a problem with PHP.
Unfortunately, PHP 3 is no longer supported. Please download
the latest version of PHP 4 from http://www.php.net/downloads.php

If you are able to reproduce the bug with one of the latest
versions of PHP, please change the PHP version on this bug report
to the version you tested and change the status back to "Open".
Again, thank you for your continued support of PHP.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Apr 20 04:01:28 2024 UTC