PHP 4.0 Bug #8078 Updated: File upload causes memory corruption / sig11 in rfc1867.c
| From: | mb at sime dot com | Date: | Wed, 20 Dec 2000 10:50:16 +0000 |
| Subject: | PHP 4.0 Bug #8078 Updated: File upload causes memory corruption / sig11 in rfc1867.c | ||
| Groups: | php.dev php.dev | ||
| Request: | Send a blank email to php-dev+get-41910@lists.php.net to get a copy of this message | ||
ID: 8078
User Update by: mb@sime.com
Old-Status: Open
Status: Closed
Bug Type: Reproduceable crash
Description: File upload causes memory corruption / sig11 in rfc1867.c
Problem fixed by changing main/rfc1867.c from
lbuf = emalloc(s-name + MAX_SIZE_OF_INDEX);
to
lbuf = emalloc(s-name + MAX_SIZE_OF_INDEX+1);
Fix is included in php 4.0.4 release.
Previous Comments:
---------------------------------------------------------------------------
[2000-12-03 11:36:28] mb@sime.com
Error occurs when using 4.0.4RC3 as well:
[Sun Dec 3 17:23:59 2000] Script: '-'
---------------------------------------
rfc1867.c(183) : Block 0x0818BAD8 status:
Beginning: OK (allocated on rfc1867.c:185, 16 bytes)
End: Overflown (magic=0x2A8FCC00 instead of 0x2A8FCC84)
1 byte(s) overflown
You can find the page I'm submiting on http://mabene.sime.com/edit_dokument.htm. just
submitting this to a dummy-script (something like
<? phpinfo(); ?>
will give you 6 of the messages above.
configure:
./configure
--enable-debug
--enable-track-vars
--with-config-file-path=/etc/
--enable-trans-sid
--enable-discard-path
--without-msql
--without-mysql
--enable-force-cgi-redirect
---------------------------------------------------------------------------
[2000-12-03 00:04:46] sniper@php.net
Please check if this happens with the PHP4.0.4RC3:
http://www.php.net/distributions/php-4.0.4RC3.tar.gz
--Jani
---------------------------------------------------------------------------
[2000-12-02 09:44:09] mb@sime.com
When receiving posted data with enctype="multipart/form-data" php exits with sig11; after
compiling php to run as cgi with debug information I get the following error message:
[Fri Dec 1 15:22:48 2000] Script: '/home/httpd/login/htdocs/intranet/arch/save_dok.php'
---------------------------------------
rfc1867.c(182) : Block 0x081DD568 status:
Beginning: OK (allocated on rfc1867.c:184, 16 bytes)
End: Overflown (magic=0x2A8FCC00 instead of 0x2A8FCC84)
1 byte(s) overflown
---------------------------------------
Looks like there's something wrong with the decoder for multipart-formdata.
---------------------------------------------------------------------------
Full Bug description available at: http://bugs.php.net/?id=8078