Bug #72053 [Opn]: Multipart request is parsed differently for nearly equal "Content-Disposition"

Edit report at https://bugs.php.net/bug.php?id=72053&edit=1 ID: 72053 User updated by: mail at michael-kaufmann dot ch Reported by: mail at michael-kaufmann dot ch Summary: Multipart request is parsed differently for nearly equal "Content-Disposition" Status: Open Type: Bug Package: *General Issues Operating System: Linux -PHP Version: 5.6.20 +PHP Version: 7.0.7 Block user comment: N Private report: N New Comment: This is what happens: next_line() in rfc1867.c returns a partial (truncated) header line for very long headers. multipart_buffer_headers() processes this partial header line like a complete header line if it contains a colon (":"). The remaining part of the header line is then processed as a separate header. In the example, the "Content-Disposition" header is split like this: First header: - name: Content-Disposition - value: form-data; name="test"; aaaaaaaaa...aaaaaaaaaa Second header: - name: (empty) - value: ; filename="test.txt" Previous Comments: ------------------------------------------------------------------------ [2016-04-18 21:17:46] mail at michael-kaufmann dot ch Description: ------------ Fuzz testing revealed that this multipart request is parsed differently, depending on the number of 'a' characters: --BOUNDARY Content-Disposition: form-data; name="test"; aaaaaaaaa...aaaaaaaaaa:; filename="test.txt" This is a test --BOUNDARY-- For up to 5074 'a' characters, PHP parses this as a file upload: _FILES["test"] contains an array. For 5075 'a' characters and more, PHP parses this as a POST parameter: _POST["test"] contains the string "This is a test". This is very strange behavior. I expect that PHP parses these requests the same way, regardless of the number of 'a' characters. Test script: --------------- #!/bin/bash ( printf -- "--BOUNDARY\r\n" printf -- "Content-Disposition: form-data; name=\"test\"; " printf -- "a%.0s" {1..5074} printf -- ":; filename=\"test.txt\"\r\n" printf -- "\r\n" printf -- "This is a test\r\n" printf -- "--BOUNDARY--" ) > /tmp/test.dat curl -H "Content-Type: multipart/form-data; boundary=BOUNDARY" --data-binary @/tmp/test.dat http://.../phpinfo.php ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72053&edit=1