cvs: php4 /main rfc1867.c

sesser Sun Dec 16 08:34:52 2001 EDT Modified files: /php4/main rfc1867.c Log: fixed: php_ap_getword was unaware of quotes filenames with ; in it could not get uploaded fixed: php_ap_getword_conf sometimes returned a static string that crashs php when freed (f.e. uploading the file "crash; name= ;" crashed php) fixed: magic_quotes was disabled while filling variables with user supplied input fixed: memoryleak (some strings did not get freed) fixed: assuming that adress of "" is always the same may fail on some compilers Index: php4/main/rfc1867.c diff -u php4/main/rfc1867.c:1.90 php4/main/rfc1867.c:1.91 --- php4/main/rfc1867.c:1.90 Thu Dec 13 13:12:58 2001 +++ php4/main/rfc1867.c Sun Dec 16 08:34:52 2001 @@ -16,7 +16,7 @@ | Jani Taskinen <sniper@php.net> | +----------------------------------------------------------------------+ */ -/* $Id: rfc1867.c,v 1.90 2001/12/13 18:12:58 sesser Exp $ */ +/* $Id: rfc1867.c,v 1.91 2001/12/16 13:34:52 sesser Exp $ */ /* * This product includes software developed by the Apache Group @@ -384,10 +384,25 @@ static char *php_ap_getword(char **line, char stop) { - char *pos = strchr(*line, stop); + char *pos = *line, quote; char *res; - if (!pos) { + while (*pos && *pos != stop) { + + if ((quote = *pos) == '"' || quote == '\'') { + ++pos; + while (*pos && *pos != quote) { + if (*pos == '\\' && pos[1] && pos[1] == quote) { + pos += 2; + } else { + ++pos; + } + } + ++pos; + } else ++pos; + + } + if (*pos == '\0') { res = estrdup(*line); *line += strlen(*line); return res; @@ -433,7 +448,7 @@ if (!*str) { *line = str; - return ""; + return estrdup(""); } if ((quote = *str) == '"' || quote == '\'') { @@ -647,7 +662,7 @@ while (*cd && (pair = php_ap_getword(&cd, ';'))) { - char *key=NULL; + char *key=NULL, *word = pair; while (isspace(*cd)) { ++cd; @@ -657,14 +672,15 @@ key = php_ap_getword(&pair, '='); if (!strcmp(key, "name")) { + if (param) efree(param); param = php_ap_getword_conf(&pair); } else if (!strcmp(key, "filename")) { + if (filename) efree(filename); filename = php_ap_getword_conf(&pair); } } - if (key) { - efree(key); - } + if (key) efree(key); + efree(word); } /* Normal form variable, safe to read all data into memory */ @@ -672,9 +688,7 @@ char *value = multipart_buffer_read_body(mbuff TSRMLS_CC); - if (!value) { - value = ""; - } + if (!value) value = estrdup(""); safe_php_register_variable(param, value, array_ptr, 0 TSRMLS_CC); if (!strcmp(param, "MAX_FILE_SIZE")) { @@ -682,9 +696,7 @@ } efree(param); - if (value != "") { - efree(value); - } + efree(value); continue; } @@ -771,14 +783,6 @@ sprintf(lbuf, "%s_name", param); } - /* Initialize variables */ - add_protected_variable(param TSRMLS_CC); - - magic_quotes_gpc = PG(magic_quotes_gpc); - PG(magic_quotes_gpc) = 0; - /* if param is of form xxx[.*] this will cut it to xxx */ - safe_php_register_variable(param, temp_filename, NULL, 1 TSRMLS_CC); - s = strrchr(filename, '\\'); if (s && s > filename) { safe_php_register_variable(lbuf, s+1, NULL, 0 TSRMLS_CC); @@ -821,6 +825,13 @@ } register_http_post_files_variable(lbuf, cd, http_post_files, 0 TSRMLS_CC); + /* Initialize variables */ + add_protected_variable(param TSRMLS_CC); + + magic_quotes_gpc = PG(magic_quotes_gpc); + PG(magic_quotes_gpc) = 0; + /* if param is of form xxx[.*] this will cut it to xxx */ + safe_php_register_variable(param, temp_filename, NULL, 1 TSRMLS_CC); /* Add $foo[tmp_name] */ if (is_arr_upload) {