#49286 [Opn->Fbk]: php://input (php_stream_input_read) is broken

ID: 49286 Updated by: jani@php.net Reported By: jost_boekemeier at users dot sf dot net -Status: Open +Status: Feedback -Bug Type: Unknown/Other Function +Bug Type: Filesystem function related Operating System: * -PHP Version: 5.2.10 +PHP Version: 5.2.5 New Comment: Who are you talking to? Where's the reproduce code that crashes? (fyi: simple fopen("php://input","r"); certainly does NOT crash in PHP_5_2 or PHP_5_3 or HEAD right now. Previous Comments: ------------------------------------------------------------------------ [2009-08-18 12:03:18] jost_boekemeier at users dot sf dot net Description: ------------ You are right, when calling fopen("php://input", "r") PHP version 5 may crash or hang. Please do not use it until this PHP5 bug is fixed. I have looked at php 5.2.5. In php_fopen_wrapper.c line 81 it reads the raw_post_data and then increments the SG(read_post_bytes) even though it hasn't read anything. The result is that SG(read_post_bytes) is twice the CONTENT_LENGTH size, causing all sorts of strage side effects later on. Reproduce code: --------------- Current code from http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php_fopen_wrapper.c?revision=276986&view=markup if(SG(request_info).raw_post_data) { /* data has already been read by a post handler */ read_bytes = SG(request_info).raw_post_data_length - *position; ... SG(read_post_bytes) += read_bytes; Suggested fix; make read_bytes a local var: size_t read_bytes = SG(request_info).raw_post_data_length - *position; ^^^^^^^ Expected result: ---------------- SG(read_post_bytes) == CONTENT_LENGTH Actual result: -------------- SG(read_post_bytes) 2 times CONTENT_LENGTH ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=49286&edit=1