Bug #72053 [NEW]: Multipart request is parsed differently for nearly equal "Content-Disposition"
From: mail at michael-kaufmann dot ch
Operating system: Linux
PHP version: 5.6.20
Package: *General Issues
Bug Type: Bug
Bug description:Multipart request is parsed differently for nearly equal
"Content-Disposition"
Description:
------------
Fuzz testing revealed that this multipart request is parsed differently,
depending on the number of 'a' characters:
--BOUNDARY
Content-Disposition: form-data; name="test"; aaaaaaaaa...aaaaaaaaaa:;
filename="test.txt"
This is a test
--BOUNDARY--
For up to 5074 'a' characters, PHP parses this as a file upload:
_FILES["test"] contains an array.
For 5075 'a' characters and more, PHP parses this as a POST parameter:
_POST["test"] contains the string "This is a test".
This is very strange behavior. I expect that PHP parses these requests
the same way, regardless of the number of 'a' characters.
Test script:
---------------
#!/bin/bash
(
printf -- "--BOUNDARY\r\n"
printf -- "Content-Disposition: form-data; name=\"test\"; "
printf -- "a%.0s" {1..5074}
printf -- ":; filename=\"test.txt\"\r\n"
printf -- "\r\n"
printf -- "This is a test\r\n"
printf -- "--BOUNDARY--"
) > /tmp/test.dat
curl -H "Content-Type: multipart/form-data; boundary=BOUNDARY"
--data-binary @/tmp/test.dat http://.../phpinfo.php
--
Edit bug report at https://bugs.php.net/bug.php?id=72053&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72053&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72053&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72053&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=72053&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=72053&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=72053&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=72053&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=72053&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=72053&r=support
Expected behavior: https://bugs.php.net/fix.php?id=72053&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=72053&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=72053&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=72053&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72053&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=72053&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=72053&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=72053&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=72053&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=72053&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=72053&r=mysqlcfg
Thread (3 messages)
- mail at michael-kaufmann dot ch