Bug #3665: Simple bug in setCookie()

From: dk@dizain.ru Operating system: Win32, FreeBSD PHP version: 3.0.15 PHP Bug Type: Other Bug description: Simple bug in setCookie() Dear PHP developers team! First, let me thank you for PHP processor - I think it's the best server-sige language for CGI creation. I have found a little bug in function SetCookie(). When I use PHP command something like this: $TestCook=';;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;'; // 36 or more characters setCookie("TestCook",$TestCook,0x7FFFFFFF); it fails with General Protection Fault. But if I use only 35 or less ";"s, it works. I think I know the root of this problem. Inside source file "functions/head.c", in function _phps_SetCoolie we have: // file functions/head.c, line 462 // len=0 first, name, value, etc. are the function parameters (char*) if (name) len += strlen(name); if (value) len += strlen(value); if (path) len += strlen(path); if (domain) len += strlen(domain); tempstr = emalloc(len + 100); ........ r = _php3_urlencode(value, strlen (value)); sprintf(tempstr, "%s=%s", name, value ? r : ""); /// ?????!!!!! When we use sprintf(tempstr,...) we will have the string bigger than len+100 symbols (ya, every ";" character translates to "%XX", and 36*3 greater than 100). To fix this problem, we can use following code: ....... r = _php3_urlencode(value, strlen (value)); efree(tempstr); tempstr=emalloc(strlen(r)+200); sprintf(tempstr, "%s=%s", name, value ? r : ""); Thanks before. PS: I'm sorry of my bad English...