PHP 4.0 Bug #8078 Updated: File upload causes memory corruption / sig11 in rfc1867.c

ID: 8078 User Update by: mb@sime.com Old-Status: Open Status: Closed Bug Type: Reproduceable crash Description: File upload causes memory corruption / sig11 in rfc1867.c Problem fixed by changing main/rfc1867.c from lbuf = emalloc(s-name + MAX_SIZE_OF_INDEX); to lbuf = emalloc(s-name + MAX_SIZE_OF_INDEX+1); Fix is included in php 4.0.4 release. Previous Comments: --------------------------------------------------------------------------- [2000-12-03 11:36:28] mb@sime.com Error occurs when using 4.0.4RC3 as well: [Sun Dec 3 17:23:59 2000] Script: '-' --------------------------------------- rfc1867.c(183) : Block 0x0818BAD8 status: Beginning: OK (allocated on rfc1867.c:185, 16 bytes) End: Overflown (magic=0x2A8FCC00 instead of 0x2A8FCC84) 1 byte(s) overflown You can find the page I'm submiting on http://mabene.sime.com/edit_dokument.htm. just submitting this to a dummy-script (something like <? phpinfo(); ?> will give you 6 of the messages above. configure: ./configure --enable-debug --enable-track-vars --with-config-file-path=/etc/ --enable-trans-sid --enable-discard-path --without-msql --without-mysql --enable-force-cgi-redirect --------------------------------------------------------------------------- [2000-12-03 00:04:46] sniper@php.net Please check if this happens with the PHP4.0.4RC3: http://www.php.net/distributions/php-4.0.4RC3.tar.gz --Jani --------------------------------------------------------------------------- [2000-12-02 09:44:09] mb@sime.com When receiving posted data with enctype="multipart/form-data" php exits with sig11; after compiling php to run as cgi with debug information I get the following error message: [Fri Dec 1 15:22:48 2000] Script: '/home/httpd/login/htdocs/intranet/arch/save_dok.php' --------------------------------------- rfc1867.c(182) : Block 0x081DD568 status: Beginning: OK (allocated on rfc1867.c:184, 16 bytes) End: Overflown (magic=0x2A8FCC00 instead of 0x2A8FCC84) 1 byte(s) overflown --------------------------------------- Looks like there's something wrong with the decoder for multipart-formdata. --------------------------------------------------------------------------- Full Bug description available at: http://bugs.php.net/?id=8078 -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net