Bug #7198: crash due to bug/feature in mime.c see also BUGID#7179

From: liinu@uta.fi Operating system: Solaris 2.6 PHP version: 3.0.17 PHP Bug Type: Reproduceable crash Bug description: crash due to bug/feature in mime.c see also BUGID#7179 See also BUG#7179. This is addendum to that bug. Here's gdb's back trace: #0 0xef524734 in strlen () #1 0x55248 in php3_mime_split () #2 0x59f40 in php3_getpost () #3 0x5a554 in php3_treat_data () #4 0x2e1bc in _php3_hash_environment () #5 0x81974 in lex_scan () #6 0x3484c in read_next_token () #7 0x2cc4c in phplex () #8 0x7572c in phpparse () #9 0x2e698 in php3_parse () #10 0x2e9c0 in apache_php3_module_main () #11 0x2bcb8 in send_php3 () #12 0x2bd30 in send_parsed_php3 () #13 0x87770 in ap_invoke_handler () #14 0x98340 in process_request_internal () #15 0x98398 in ap_process_request () #16 0x911c8 in child_main () #17 0x91368 in make_child () #18 0x914b0 in startup_children () #19 0x91a5c in standalone_main () Something odd going on in functions/mime.c with php3 3.0.17. With some searching and trying various things this diff seems to fix/avoid this crash. This diff removes if(memcmp(...), which is causing the crash.test. In some ways revert back to way the functions/mime.c behaved in php3 3.0.16: --- functions/mime.c.orig Sun Sep 10 00:05:45 2000 +++ functions/mime.c Fri Oct 13 22:51:01 2000 @@ -183,10 +183,8 @@ } *(loc - 4) = '\0'; - /* Check to make sure we are not overwriting special file upload variables */ - if(memcmp(namebuf,sbuf,strlen(sbuf))) { - _php3_parse_gpc_data(ptr,namebuf,http_post_vars); - } + /* Magic function that figures everything out */ + _php3_parse_gpc_data(ptr,namebuf,http_post_vars); /* And a little kludge to pick out special MAX_FILE_SIZE */ itype = php3_check_ident_type(namebuf);