#39927 [NEW]: server variable names are silently changed
From: to_devnull at yahoo dot com
Operating system: all
PHP version: 5.2.0
PHP Bug Type: Apache related
Bug description: server variable names are silently changed
Description:
------------
I'm "reopening" Bug #13961 since some moron marked it as "bogus" and I
can't comment on it:
http://bugs.php.net/bug.php?id=13961
Apache module mod_setenvif sets variables in
r->subprocess_env. If variable name contains character ".", then
sapi_apache_register_server_variables() will
replace it with "_". This breaks internal
variables like force-response-1.0 (php changes it to
force-response-1_0).
I hit this bug with PHP4.4.3/PHP5 and latest Apache 1.3.37. Spent several
hours tracing in debugger why "downgrade-1.0" becomes "downgrade-1_0".
This is a serious bug -- basically it's impossible to downgrade client
request/server response to HTTP 1.0 (or disable chunking) if php is
involved. What a shame!
Reproduce code:
---------------
I actually traced it by shoving a static string containing '.' in
r->subprocess_env and thus getting Apache to core dump when php tries to
write to read-only memory in php_register_variable_ex().
--
Edit bug report at http://bugs.php.net/?id=39927&edit=1
--
Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=39927&r=trysnapshot44
Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=39927&r=trysnapshot52
Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=39927&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=39927&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=39927&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=39927&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=39927&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=39927&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=39927&r=support
Expected behavior: http://bugs.php.net/fix.php?id=39927&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=39927&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=39927&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=39927&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=39927&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=39927&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=39927&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=39927&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=39927&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=39927&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=39927&r=mysqlcfg
Thread (6 messages)
- to_devnull at yahoo dot com