Bug #3812: urlencode not bin-safe

From: baumert@pilot-webdesign.de Operating system: Linux Redhat 5.2, 2.0.36, glibc2 PHP version: 3.0.15 PHP Bug Type: Reproduceable crash Bug description: urlencode not bin-safe The urlencode function is not binary safe. It retrieves the length of the string to encode as a parameter, then uses strlen to allocate the new buffer. Strlen returns wrong length for the bin-string. After that, the len-parameter is used to fill the buffer => a buffer-overwrite occurs. php 4 beta 4 pl1: change line 241 from str = (unsigned char *) emalloc(3 * strlen(s) + 1); to str = (unsigned char *) emalloc(3 * len + 1); php 3.15 change line 242 from str = (unsigned char *) emalloc(3 * strlen(s) + 1); to str = (unsigned char *) emalloc(3 * len + 1);