Bug #72053 [Opn->Ver]: Multipart request is parsed differently for nearly equal "Content-Disposition"

Edit report at https://bugs.php.net/bug.php?id=72053&edit=1 ID: 72053 Updated by: cmb@php.net Reported by: mail at michael-kaufmann dot ch Summary: Multipart request is parsed differently for nearly equal "Content-Disposition" -Status: Open +Status: Verified Type: Bug Package: *General Issues Operating System: Linux -PHP Version: 7.0.7 +PHP Version: 7.4 Block user comment: N Private report: N New Comment: Thanks, you're analysis looks right. A possible solution might be to add a flag to multipart_buffer which signals the partial line, and to catch that like we already catch lines beginning with whitespace (to support line folding)[1]. [1] <https://github.com/php/php-src/blob/php-7.4.16/main/rfc1867.c#L423-L426> Previous Comments: ------------------------------------------------------------------------ [2016-06-12 18:19:23] mail at michael-kaufmann dot ch This is what happens: next_line() in rfc1867.c returns a partial (truncated) header line for very long headers. multipart_buffer_headers() processes this partial header line like a complete header line if it contains a colon (":"). The remaining part of the header line is then processed as a separate header. In the example, the "Content-Disposition" header is split like this: First header: - name: Content-Disposition - value: form-data; name="test"; aaaaaaaaa...aaaaaaaaaa Second header: - name: (empty) - value: ; filename="test.txt" ------------------------------------------------------------------------ [2016-04-18 21:17:46] mail at michael-kaufmann dot ch Description: ------------ Fuzz testing revealed that this multipart request is parsed differently, depending on the number of 'a' characters: --BOUNDARY Content-Disposition: form-data; name="test"; aaaaaaaaa...aaaaaaaaaa:; filename="test.txt" This is a test --BOUNDARY-- For up to 5074 'a' characters, PHP parses this as a file upload: _FILES["test"] contains an array. For 5075 'a' characters and more, PHP parses this as a POST parameter: _POST["test"] contains the string "This is a test". This is very strange behavior. I expect that PHP parses these requests the same way, regardless of the number of 'a' characters. Test script: --------------- #!/bin/bash ( printf -- "--BOUNDARY\r\n" printf -- "Content-Disposition: form-data; name=\"test\"; " printf -- "a%.0s" {1..5074} printf -- ":; filename=\"test.txt\"\r\n" printf -- "\r\n" printf -- "This is a test\r\n" printf -- "--BOUNDARY--" ) > /tmp/test.dat curl -H "Content-Type: multipart/form-data; boundary=BOUNDARY" --data-binary @/tmp/test.dat http://.../phpinfo.php ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72053&edit=1