Bug #61218 [NEW]: FPM doesn't receive binary values in FastCGI requests
From:
Operating system: Ubuntu 10.04.4 LTS x64
PHP version: 5.3.10
Package: FPM related
Bug Type: Bug
Bug description:FPM doesn't receive binary values in FastCGI requests
Description:
------------
The function fcgi_get_params() checks fastcgi name-value pairs on their
effective sizes using fcgi_param_get_eff_len().
This works good only for zero-ended string values, but not the binary data.
Suppose we want to transmit binary data with zeroes in the middle.
In that case fcgi_param_get_eff_len() returns 0. That causes FPM to drop
FastCGI connection.
Test script:
---------------
How to reproduce (passing binary client address in BREMOTE_ADDR):
nginx server configuration:
http://www.box.com/s/dduo08uni67ilgjnn6rc
TCP session dump (tcpdump -ni lo port 4006 -X -s 0):
http://www.box.com/s/ukkyco8raeijvb3hr8ep
Expected result:
----------------
Expected: full response from PHP.
Actual result:
--------------
Actually got: TCP reset immediately after receiving data packet with
FastCGI request.
You may decode bytes sequence in the data packet. Bytes from 0x0094 to
0x00A5 are:
0x0094 = x0c = 12 (the length of "BREMOTE_ADDR" string)
0x0095 = x04 = 04 (the length of binary data)
0x0096-0x00A1 = "BREMOTE_ADDR" (the name)
0x00A2-0x00A5 = 0x7f 0x00 0x00 0x01 (the binary representation of IPv4
address 127.0.0.1)
I found something like FastCGI specs on
http://www.fastcgi.com/drupal/node/6?q=node/22#S5.2
"3.4 Name-Value Pairs
...
This name-value pair format allows the sender to transmit binary values
without additional encoding,
and enables the receiver to allocate the correct amount of storage
immediately even for large values."
Thus, I think assuming that all FastCGI data is a zero-ended strings is
wrong.
I wrote a patch that removes check for non-zero byte after "end of string".
--
Edit bug report at https://bugs.php.net/bug.php?id=61218&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=61218&r=trysnapshot54
Try a snapshot (PHP 5.3): https://bugs.php.net/fix.php?id=61218&r=trysnapshot53
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=61218&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=61218&r=fixed
Fixed in SVN and need be documented: https://bugs.php.net/fix.php?id=61218&r=needdocs
Fixed in release: https://bugs.php.net/fix.php?id=61218&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=61218&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=61218&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=61218&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=61218&r=support
Expected behavior: https://bugs.php.net/fix.php?id=61218&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=61218&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=61218&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=61218&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=61218&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=61218&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=61218&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=61218&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=61218&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=61218&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=61218&r=mysqlcfg
Thread (6 messages)
- bruzh2 at gmail dot com