#48597 [NEW]: unexpected gpc variable parsing

From: crmalibu at gmail dot com Operating system: n/a PHP version: 5.2.9 PHP Bug Type: Variables related Bug description: unexpected gpc variable parsing Description: ------------ I marked the version as 5.2.9 but it looks like the relevant code is the same for 5.3 and php 6 as well. I don't know c, so I struggle to read the source code, but I think I found something unexpected. In main/php_variables.c in php_register_variable_ex I think the parsing behaves inconsistent. After reading the comments in the source code, I would think a gpc variable name should not make it through which has ' ' or '.' or '[' character in the name. But I've found a way to do it. It seems the routine for recognizing and parsing the array syntax is at fault. In particular, characters after the first occurrence of a '[' char will be left alone because it thinks it needs to parse it as the special array syntax. But while it does later recognize that it's not proper array syntax, it doesn't properly convert the remaining character to underscore. I don't know if this is a bug, or if it's serious or what. But the source code comment about removing those chars due to not being binary safe made me think someone needs to look at this. Reproduce code: --------------- <form action=> <input name="goodvar .["> <input name="goodarray[foo]"> <input name="badvar[ . ["> <input type=submit> </form> <?php print_r($_GET); ?> Expected result: ---------------- Array ( [goodvar___] => [goodarray] => Array ( [foo] => ) [badvar_____] => ) Actual result: -------------- Array ( [goodvar___] => [goodarray] => Array ( [foo] => ) [badvar_ . [] => ) -- Edit bug report at http://bugs.php.net/?id=48597&edit=1 -- Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=48597&r=trysnapshot52 Try a CVS snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=48597&r=trysnapshot53 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=48597&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=48597&r=fixedcvs Fixed in CVS and need be documented: http://bugs.php.net/fix.php?id=48597&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=48597&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=48597&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=48597&r=needscript Try newer version: http://bugs.php.net/fix.php?id=48597&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=48597&r=support Expected behavior: http://bugs.php.net/fix.php?id=48597&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=48597&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=48597&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=48597&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=48597&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=48597&r=dst IIS Stability: http://bugs.php.net/fix.php?id=48597&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=48597&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=48597&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=48597&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=48597&r=mysqlcfg