Bug #7456: Crash when submitting form with method=post enctype=multipart/form-data

From: ralf.ertzinger@gmx.net Operating system: Linux 2.2.14-5.0 SMP (Redhat 6.2) PHP version: 3.0.17 PHP Bug Type: Reproduceable crash Bug description: Crash when submitting form with method=post enctype=multipart/form-data A PHP3-script crashes reproducable when it is target of a form-submit operation with a specific encoding (multipart/form-data) Sample script: ----------------------- <html> <head> <title>PHP Post test</title> </head> <body> <? echo "submit:$testen:<br>\n"; if($testen=="now"){ echo "$tester<br>\n"; } ?> <form method="post" action="posttest.php3" enctype="multipart/form-data"> <input type="text" size="10" name="tester" value='<? echo $tester; ?>'> <input type="submit" value="jetzt" name="testen"> </form> </body> </html> ------------ Any other type of encoding works fine. PHP3 is RPM-built from the latest RedHat sources (php-3.0.17-1.6.2.src.rpm) with two modifications: * added --with-mysql to the configure call * added --enable-versioning to the configure call (crash happens with and without PHP4 running parallel) configure call as reported by phpinfo(): ./configure '--prefix=/usr' '--with-apxs=/usr/sbin/apxs' '--with-config-file-path=/etc/httpd' '--enable-safe-mode' '--with-exec-dir=/usr/bin' '--with-system-regex' '--disable-debug' '--with-zlib' '--with-gdbm' '--with-db2' '--enable-debugger' '--enable-magic-quotes' '--enable-track-vars' '--enable-sysvsem' '--enable-sysvshm' '--enable-track-vars' '--enable-versioning' '--with-mysql' '--with-xml' '--with-ftp' gdb trace follows. #0 0x40268c0d in setenvif_module () from /usr/lib/apache/libphp3.so #1 0x402c8244 in php3_module () from /usr/lib/apache/libphp3.so #2 0x4026e07c in setenvif_module () from /usr/lib/apache/libphp3.so #3 0x4026e74e in setenvif_module () from /usr/lib/apache/libphp3.so #4 0x40260466 in setenvif_module () from /usr/lib/apache/libphp3.so #5 0x40291924 in setenvif_module () from /usr/lib/apache/libphp3.so #6 0x4023f94c in setenvif_module () from /usr/lib/apache/libphp3.so #7 0x4023fc68 in setenvif_module () from /usr/lib/apache/libphp3.so #8 0x4023caa8 in setenvif_module () from /usr/lib/apache/libphp3.so #9 0x4023cb3f in setenvif_module () from /usr/lib/apache/libphp3.so #10 0x80535ee in ap_invoke_handler () #11 0x8061d0b in ap_some_auth_required () #12 0x8061d68 in ap_process_request () #13 0x805bcf0 in ap_child_terminate () #14 0x805be57 in ap_child_terminate () #15 0x805bf58 in ap_child_terminate () #16 0x805c408 in ap_child_terminate () #17 0x805ca0f in main () #18 0x400ba9cb in __libc_start_main (main=0x805c790 <main>, argc=2, argv=0xbffffbd4, init=0x804f160 <_init>, fini=0x807bfbc <_fini>, rtld_fini=0x4000ae60 <_dl_fini>, stack_end=0xbffffbcc) at ../sysdeps/generic/libc-start.c:92