Bug #17240 Updated: curl crash with CURLOPT_POSTFIELDS set to ""

ID: 17240 Updated by: daniel@haxx.se Reported By: chris-php@bolt.cx Status: Open Bug Type: Reproducible crash Operating System: Linux 2.4.19-pre4 (Suse) PHP Version: 4.2.1 New Comment: (I'm the main author of libcurl, in which this crash happens) I believe the problem is related to what data that is actually passed in to libcurl for the CURLOPT_POSTFIELDS option. If CURLOPT_POSTFIELDS is unused, or set to 0 (zero), libcurl will strlen() the previous pointer to find out the length of it. Frame #2 shows the library depending on the pointer and a zero termination. Previous Comments: ------------------------------------------------------------------------ [2002-05-15 05:49:47] chris-php@bolt.cx This script will crash php: <? $cs = curl_init(); curl_setopt($cs, CURLOPT_VERBOSE, 1); curl_setopt($cs, CURLOPT_URL, "http://www.google.com/"); curl_setopt($cs, CURLOPT_RETURNTRANSFER, 1); curl_setopt($cs, CURLOPT_POST, 1); curl_setopt($cs, CURLOPT_POSTFIELDS, ""); echo(curl_exec($cs)); curl_close($cs); ?> $ php -q curltest.php * About to connect() to www.google.com:80 * Connected to www.google.com (216.239.51.101) port 80 Segmentation fault (core dumped) $ gdb /usr/local/bin/php ./core GNU gdb 5.2 ... Loaded symbols for /lib/libnss_dns.so.2 #0 0x40057766 in curl_mvaprintf (format=0x400ca692 "%s", ap_save=0xbfffe1fc) at mprintf.c:1065 1065 info.buffer[info.len] = 0; /* we terminate this with a zero byte */ (gdb) bt #0 0x40057766 in curl_mvaprintf (format=0x400ca692 "%s", ap_save=0xbfffe1fc) at mprintf.c:1065 #1 0x4004ad4a in add_bufferf (in=0x81dd968, fmt=0x400ca692 "%s") at http.c:180 #2 0x4004c33e in Curl_http (conn=0x81dd2c0) at http.c:942 #3 0x40052906 in Curl_do (connp=0xbfffe3e4) at url.c:2428 #4 0x4005b676 in Curl_perform (data=0x81e2928) at transfer.c:1139 #5 0x4005babf in curl_easy_perform (curl=0x81e2928) at easy.c:245 #6 0x080f10a3 in zif_curl_exec (ht=1, return_value=0x81e2024, this_ptr=0x0, return_value_used=1) at curl.c:876 #7 0x0813f6fa in execute (op_array=0x81dd1b4) at ./zend_execute.c:1598 #8 0x080cde49 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at zend.c:810 #9 0x08066fb1 in php_execute_script (primary_file=0xbffffa44) at main.c:1381 #10 0x080611b1 in main (argc=3, argv=0xbffffad4) at cgi_main.c:778 #11 0x4018bc6f in __libc_start_main () from /lib/libc.so.6 (gdb) $ php -v 4.2.1 $ curl --version curl 7.9.7 (i686-pc-linux-gnu) libcurl 7.9.7 (OpenSSL 0.9.6c) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=17240&edit=1