#23236 [NEW]: move_uploaded_file corrupts images

From: dan at GARBAGE dot highspeedlink dot net Operating system: Linux 2.4.18-14 RedHat 8 PHP version: 4.3.1 PHP Bug Type: Unknown/Other Function Bug description: move_uploaded_file corrupts images (remove GARBAGE to reply, or it gets feed into the spamtrap) Can anybody explain what's happening to perfectly good images passing through http://admin.highspeedlink.net/PHP/ for me? The code for the page is available at http://admin.highspeedlink.net/PHP/source.txt for your perusal. I've tested with MSIE 6.0 and Mozilla 1.4a on Windows, so this doesn't seem to be browser-specific. Also, running dos2unix, unix2dos, etc. doesn't seem to help. Considering what suggestions I've seen thus far, I'm thinking this is a bug, possibly related to character encoding, in move_uploaded_file(). Can people test this out and see how deadly it really is? Warning for the squeamish: the linked page allows uploading of arbitrary images up to 100 [decimal] KB in size, and displays the last uploaded image. No promises on what will or won't be there when you look. Just upload only pictures of http://www.google.com/images?q=flowers and such, okay? Feel free to upload arbitrary binary data and access it directly, as well--no filetype restrictions are in place. This is not a localized copy of Apache, and thus #11066 does not apply. (Indeed, my Apache 2.0.43 doesn't even recognize the CharsetRecodeMultipartForm directive.) -- Edit bug report at http://bugs.php.net/?id=23236&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=23236&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=23236&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=23236&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=23236&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=23236&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=23236&r=support Expected behavior: http://bugs.php.net/fix.php?id=23236&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=23236&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=23236&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=23236&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=23236&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=23236&r=dst IIS Stability: http://bugs.php.net/fix.php?id=23236&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=23236&r=gnused