#39201 [NEW]: POST with invalid content-length and ErrorDocument set crashes php

From: thomas at partyflock dot nl Operating system: Linux (2.6.18) PHP version: 5.1.6 PHP Bug Type: Apache2 related Bug description: POST with invalid content-length and ErrorDocument set crashes php Description: ------------ Insert ErrorDocument directive for error code 413 in httpd.conf: ErrorDocument 413 /anywhere Now post something to your webserver, with following invalid Content-Length: 1\r\r\n (extra carriage return) sapi_globals.request_info.post_data is allocated, in SAPI.c:sapi_read_standard_form_data on line 203. After the call to sapi_module.read_post on line 206, the POST request is transformed to a GET request for above error document and the sapi_globals.request_info.post_data is 0 at that point, resulting in a segmentation fault at SAPI.c line 223. Reproduce code: --------------- #!/usr/bin/perl -w use strict; use IO::Socket; if ($#ARGV < 0) { print STDERR "need hostname argument\n"; exit 1; } my $sock = IO::Socket::INET->new( 'PeerAddr' => $ARGV[0], 'PeerPort' => 80 ); if (!$sock) { print STDERR "failed to connect to port 80 of $ARGV[0]\n"; exit 1; } print $sock "POST / HTTP/1.0\r\n"; print $sock "Content-Length: 1\r\r\n\r\n"; print $sock "a"; undef $sock; Expected result: ---------------- Well, I'd expect it to not crash :) -- Edit bug report at http://bugs.php.net/?id=39201&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=39201&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=39201&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=39201&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=39201&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=39201&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=39201&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=39201&r=needscript Try newer version: http://bugs.php.net/fix.php?id=39201&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=39201&r=support Expected behavior: http://bugs.php.net/fix.php?id=39201&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=39201&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=39201&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=39201&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=39201&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=39201&r=dst IIS Stability: http://bugs.php.net/fix.php?id=39201&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=39201&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=39201&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=39201&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=39201&r=mysqlcfg