#39201 [Opn->Fbk]: POST with invalid content-length and ErrorDocument set crashes php

ID: 39201 Updated by: tony2001@php.net Reported By: thomas at partyflock dot nl -Status: Open +Status: Feedback Bug Type: Apache2 related Operating System: Linux (2.6.18) PHP Version: 5.1.6 New Comment: Thank you for this bug report. To properly diagnose the problem, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php for *NIX and http://bugs.php.net/bugs-generating-backtrace-win32.php for Win32 Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". Thank you for helping us make PHP better. Can't reproduce. This is the only result I see: [Fri Oct 20 02:46:09 2006] [error] [client 127.0.0.1] Invalid Content-Length Previous Comments: ------------------------------------------------------------------------ [2006-10-19 21:46:32] thomas at partyflock dot nl Happens in 5.2dev too. ------------------------------------------------------------------------ [2006-10-19 20:16:29] tony2001@php.net Please try using this CVS snapshot: http://snaps.php.net/php5.2-latest.tar.gz For Windows: http://snaps.php.net/win32/php5.2-win32-latest.zip ------------------------------------------------------------------------ [2006-10-19 20:10:24] thomas at partyflock dot nl Description: ------------ Insert ErrorDocument directive for error code 413 in httpd.conf: ErrorDocument 413 /anywhere Now post something to your webserver, with following invalid Content-Length: 1\r\r\n (extra carriage return) sapi_globals.request_info.post_data is allocated, in SAPI.c:sapi_read_standard_form_data on line 203. After the call to sapi_module.read_post on line 206, the POST request is transformed to a GET request for above error document and the sapi_globals.request_info.post_data is 0 at that point, resulting in a segmentation fault at SAPI.c line 223. Reproduce code: --------------- #!/usr/bin/perl -w use strict; use IO::Socket; if ($#ARGV < 0) { print STDERR "need hostname argument\n"; exit 1; } my $sock = IO::Socket::INET->new( 'PeerAddr' => $ARGV[0], 'PeerPort' => 80 ); if (!$sock) { print STDERR "failed to connect to port 80 of $ARGV[0]\n"; exit 1; } print $sock "POST / HTTP/1.0\r\n"; print $sock "Content-Length: 1\r\r\n\r\n"; print $sock "a"; undef $sock; Expected result: ---------------- Well, I'd expect it to not crash :) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=39201&edit=1