Bug #660: Long cookies containing characters that need encoding
| From: | drew at elysium dot demon dot co dot uk | Date: | Tue, 18 Aug 1998 09:21:20 +0000 |
| Subject: | Bug #660: Long cookies containing characters that need encoding | ||
| Groups: | php.dev | ||
| Request: | Send a blank email to php-dev+get-288@lists.php.net to get a copy of this message | ||
From: drew@elysium.demon.co.uk
Operating system: Redhat Linux 4.2
PHP version: 3.0.3
PHP Bug Type: Reproduceable crash
Bug description:
Using the SetCookie function set a long cookie containg lots of characters that need encoding. The
following patch fixes
the problem, the size of the value string was calculated before it was encoded, and the string gets
larger after encoding.
*** head.c.orig Fri Aug 7 22:37:32 1998
--- head.c Mon Aug 17 14:23:52 1998
***************
*** 233,239 ****
CookieList *cookie;
int len = 0;
time_t t;
! char *r, *dt;
#endif
#if APACHE || defined(USE_SAPI) || FHTTPD
char *tempstr;
--- 233,239 ----
CookieList *cookie;
int len = 0;
time_t t;
! char *dt, *cookievalue = NULL;
#endif
#if APACHE || defined(USE_SAPI) || FHTTPD
char *tempstr;
***************
*** 259,266 ****
while (cookie) {
if (cookie->name)
len += strlen(cookie->name);
! if (cookie->value)
! len += strlen(cookie->value);
if (cookie->path)
len += strlen(cookie->path);
if (cookie->domain)
--- 259,268 ----
while (cookie) {
if (cookie->name)
len += strlen(cookie->name);
! if (cookie->value) {
! cookievalue = _php3_urlencode(cookie->value, str
len (cookie->value));
! len += strlen(cookievalue);
! }
if (cookie->path)
len += strlen(cookie->path);
if (cookie->domain)
***************
*** 280,292 ****
efree(dt);
} else {
/* FIXME: XXX: this is not binary data safe */
! r = _php3_urlencode(cookie->value, strlen (cooki
e->value));
! sprintf(tempstr, "%s=%s", cookie->name, cookie->
value ? r : "");
! if (r) efree(r);
if (cookie->name) efree(cookie->name);
if (cookie->value) efree(cookie->value);
cookie->name=NULL;
cookie->value=NULL;
if (cookie->expires > 0) {
strcat(tempstr, "; expires=");
dt = php3_std_date(cookie->expires);
--- 282,294 ----
efree(dt);
} else {
/* FIXME: XXX: this is not binary data safe */
! sprintf(tempstr, "%s=%s", cookie->name, cookie->
value ? cookievalue : "");
if (cookie->name) efree(cookie->name);
if (cookie->value) efree(cookie->value);
+ if (cookievalue) efree(cookievalue);
cookie->name=NULL;
cookie->value=NULL;
+ cookievalue=NULL;
if (cookie->expires > 0) {
strcat(tempstr, "; expires=");
dt = php3_std_date(cookie->expires);
***************
*** 314,319 ****
--- 316,322 ----
if (cookie->path) efree(cookie->path);
if (cookie->name) efree(cookie->name);
if (cookie->value) efree(cookie->value);
+ if (cookievalue) efree(cookievalue);
efree(cookie);
cookie = php3_PopCookieList();
efree(tempstr);
--
PHP Development Mailing List http://www.php.net/
To unsubscribe send an empty message to php-dev-unsubscribe@lists.php.net
For help: php-dev-help@lists.php.net