cvs: php3 /functions mime.c

rasmus Sun Sep 3 22:21:46 2000 EDT Modified files: /php3/functions mime.c Log: Quick-fix for file-upload security issue Index: php3/functions/mime.c diff -u php3/functions/mime.c:1.61 php3/functions/mime.c:1.62 --- php3/functions/mime.c:1.61 Fri Dec 31 20:31:16 1999 +++ php3/functions/mime.c Sun Sep 3 22:21:46 2000 @@ -26,7 +26,7 @@ | Authors: Rasmus Lerdorf <rasmus@php.net> | +----------------------------------------------------------------------+ */ -/* $Id: mime.c,v 1.61 2000/01/01 04:31:16 sas Exp $ */ +/* $Id: mime.c,v 1.62 2000/09/04 05:21:46 rasmus Exp $ */ #include <stdio.h> #include "php.h" #include "internal_functions.h" @@ -49,7 +49,7 @@ char *ptr, *loc, *loc2, *s, *name, *filename, *u, *fn; int len, state = 0, Done = 0, rem, urem; long bytes, max_file_size = 0; - char *namebuf=NULL, *filenamebuf=NULL, *lbuf=NULL, *abuf=NULL; + char *namebuf=NULL, *filenamebuf=NULL, *lbuf=NULL, *abuf=NULL, *sbuf=NULL; char sbytes[16]; FILE *fp; int itype; @@ -136,8 +136,10 @@ } abuf = estrndup(namebuf, strlen(namebuf) - 2); sprintf(lbuf, "%s_name[]", abuf); + sbuf=estrdup(abuf); } else { sprintf(lbuf, "%s_name", namebuf); + sbuf=estrdup(namebuf); } s = strrchr(filenamebuf, '\\'); if (s && s > filenamebuf) { @@ -181,8 +183,10 @@ } *(loc - 4) = '\0'; - /* Magic function that figures everything out */ - _php3_parse_gpc_data(ptr,namebuf,http_post_vars); + /* Check to make sure we are not overwriting special file upload variables */ + if(memcmp(namebuf,sbuf,strlen(sbuf))) { + _php3_parse_gpc_data(ptr,namebuf,http_post_vars); + } /* And a little kludge to pick out special MAX_FILE_SIZE */ itype = php3_check_ident_type(namebuf); @@ -271,6 +275,7 @@ break; } } + if(sbuf) efree(sbuf); SAFE_RETURN; }