Re: Bug #3665: Simple bug in setCookie()

are u sure you're using 3.0.15? i'm sure this is fixed in 3.0.15! ... #if APACHE if (name) name = estrdup(name); if (value) value = estrdup(value); if (path) path = estrdup(path); if (domain) domain = estrdup(domain); php3_PushCookieList(name, value, expires, path, domain, secure); #else if (name) len += strlen(name); if (value) { encoded_value = _php3_urlencode(value, strlen (value)); len += strlen(encoded_value); } if (path) len += strlen(path); if (domain) len += strlen(domain); tempstr = emalloc(len + 100); if (!value || (value && !*value)) { /* .. is the "crucial" code snippet! plz doublecheck if you're really loking at the right version. On Tue, Feb 29, 2000 at 02:00:17PM -0000, dk@dizain.ru wrote: > From: dk@dizain.ru > Operating system: Win32, FreeBSD > PHP version: 3.0.15 > PHP Bug Type: Other > Bug description: Simple bug in setCookie() > > Dear PHP developers team! First, let me thank you for PHP processor - I think it's the > best > server-sige language for CGI creation. > > I have found a little bug in function SetCookie(). When > I use PHP command something like this: > > $TestCook=';;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;'; // 36 or more characters > setCookie("TestCook",$TestCook,0x7FFFFFFF); > > it fails with General Protection Fault. But if I use only 35 or less ";"s, > it works. > > I think I know the root of this problem. Inside source file > "functions/head.c", in function _phps_SetCoolie we have: > > // file functions/head.c, line 462 > // len=0 first, name, value, etc. are the function parameters (char*) > if (name) len += strlen(name); > if (value) len += strlen(value); > if (path) len += strlen(path); > if (domain) len += strlen(domain); > tempstr = emalloc(len + 100); > ........ > r = _php3_urlencode(value, strlen (value)); > sprintf(tempstr, "%s=%s", name, value ? r : ""); /// ?????!!!!! > > When we use sprintf(tempstr,...) we will have the string bigger than > len+100 symbols (ya, every ";" character translates to "%XX", and > 36*3 greater than 100). > > To fix this problem, we can use following code: > > ....... > r = _php3_urlencode(value, strlen (value)); > efree(tempstr); tempstr=emalloc(strlen(r)+200); > sprintf(tempstr, "%s=%s", name, value ? r : ""); > > Thanks before. > PS: > I'm sorry of my bad English... > > > > -- > PHP Development Mailing List <http://www.php.net/> > To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net > For additional commands, e-mail: php-dev-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > -- Thies C. Arntzen "One Big-Mac, Small Fries and a Coke!" Digital Collections Phone +49 40 235350 Fax +49 40 23535180 Hammerbrookstr. 93 20097 Hamburg / Germany