Bug #60206 [Dup]: possible integer overflow in content_length

Edit report at https://bugs.php.net/bug.php?id=60206&edit=1 ID: 60206 Updated by: laruence@php.net Reported by: laruence@php.net Summary: possible integer overflow in content_length Status: Duplicate Type: Bug Package: *General Issues PHP Version: 5.3.8 Block user comment: N Private report: N New Comment: dup to #60205 and this problem exists not only in apache2handler sapi but other sapis Previous Comments: ------------------------------------------------------------------------ [2011-11-03 07:41:58] laruence@php.net dup to #20605 ------------------------------------------------------------------------ [2011-11-03 07:41:40] laruence@php.net Description: ------------ in php_apache_request_ctor (sapi/apache2handler/sapi_apache2.c) SG(request_info).content_length = (content_length ? atoi(content_length) : 0); so when the content_length exceed INT_MAX, the content_length will be a wrong value. Test script: --------------- none Expected result: ---------------- none Actual result: -------------- none ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=60206&edit=1