Bug #60206 [Dup->Csd]: possible integer overflow in content_length

Edit report at https://bugs.php.net/bug.php?id=60206&edit=1 ID: 60206 Updated by: laruence@php.net Reported by: laruence@php.net Summary: possible integer overflow in content_length -Status: Duplicate +Status: Closed Type: Bug Package: *General Issues PHP Version: 5.3.8 Block user comment: N Private report: N New Comment: Automatic comment on behalf of laruence Revision: http://git.php.net/?p=php-src.git;a=commit;h=d7d0d0724c5de6397a4c9999568bc1fd7105ef5f Log: Fixed bug #60206 (possible integer overflow in content_length) Previous Comments: ------------------------------------------------------------------------ [2012-07-24 23:39:07] rasmus@php.net Automatic comment on behalf of laruence Revision: http://git.php.net/?p=php-src.git;a=commit;h=d7d0d0724c5de6397a4c9999568bc1fd7105ef5f Log: Fixed bug #60206 (possible integer overflow in content_length) ------------------------------------------------------------------------ [2012-04-18 09:48:01] laruence@php.net Automatic comment on behalf of laruence Revision: http://git.php.net/?p=php-src.git;a=commit;h=d7d0d0724c5de6397a4c9999568bc1fd7105ef5f Log: Fixed bug #60206 (possible integer overflow in content_length) ------------------------------------------------------------------------ [2011-11-03 07:43:09] laruence@php.net dup to #60205 and this problem exists not only in apache2handler sapi but other sapis ------------------------------------------------------------------------ [2011-11-03 07:41:58] laruence@php.net dup to #20605 ------------------------------------------------------------------------ [2011-11-03 07:41:40] laruence@php.net Description: ------------ in php_apache_request_ctor (sapi/apache2handler/sapi_apache2.c) SG(request_info).content_length = (content_length ? atoi(content_length) : 0); so when the content_length exceed INT_MAX, the content_length will be a wrong value. Test script: --------------- none Expected result: ---------------- none Actual result: -------------- none ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=60206&edit=1