Re: cvs: php4(PHP_4_0_7) /main rfc1867.c

Hello, Ehmm lets assume the memchr returns the last byte of the buffer. The buffer is zero so the +1 will set loc to point to a '\0' that means the while loop will not be called because '\0' is not ' ' or '\t'. rem will become -1 and ptr will point to '\0'. The strcasecmp will fail because of that. And because rem is below 31 it will leave the function. Now assume the memchr returns NULL. This will crash at the beginning of the while loop. Now assume we execute the inner while loop atleast once. Because rem is not decreased within this loop it cannot become negative and the worst thing that could happen is that memchr returns the last char... You can continue at the top of this mail to see what will happen... So all that is possible in 4.1.2 is to cause a segfault. But the same was possible before, too. Stefan Esser