#43311 [NEW]: setcookie should not be able to set cookies larger than 4096 bytes

From: crrodriguez at suse dot de Operating system: Irrelevant PHP version: 5.3CVS-2007-11-16 (CVS) PHP Bug Type: *General Issues Bug description: setcookie should not be able to set cookies larger than 4096 bytes Description: ------------ The following report caught my attention http://www.securityfocus.com/archive/1/483705 That is indeed a bug in Konqueror, but if you look the "reproduce code" it says. Reproduce code: --------------- <?php ini_set("memory_limit","200M"); setcookie("hi_fox", str_repeat("A",19999999)); ?> Expected result: ---------------- PHP limiting the cookie size to what both the spec says and other browsers do, that is name_len + value_len not larger than 4096 bytes. http://www.15seconds.com/faq/Cookies/388.htm http://wp.netscape.com/newsref/std/cookie_spec.html E-Warning "Cookie cannot store more than %d bytes of data" Actual result: -------------- PHP setting a 200MB cookie anyway. patch here : http://rafb.net/p/zs0ojA57.html -- Edit bug report at http://bugs.php.net/?id=43311&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=43311&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=43311&r=trysnapshot52 Try a CVS snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=43311&r=trysnapshot53 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=43311&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=43311&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=43311&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=43311&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=43311&r=needscript Try newer version: http://bugs.php.net/fix.php?id=43311&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=43311&r=support Expected behavior: http://bugs.php.net/fix.php?id=43311&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=43311&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=43311&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=43311&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=43311&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=43311&r=dst IIS Stability: http://bugs.php.net/fix.php?id=43311&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=43311&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=43311&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=43311&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=43311&r=mysqlcfg