Re: PHP 4.0 Bug #8486 Updated: Error parsing form data field names in rfc1867.c

On Thu, Jan 18, 2001 at 02:25:22AM -0500, Nalin Dahyabhai wrote: > I finally got some time to pull the diff from 1.54 to 1.56 and try > it out. It's better, but not quite right. It looks like the variable > name isn't being terminated in the right place -- a dump of the output > from phpinfo() shows that the variable names include a carriage return > at the end of their names ("testvariable^M"). It looks like the variable name is cut at the \n which follows the name, but there's a \r before it. I'm attaching a patch for this. > Terminating at the first whitespace or semicolon if s is NULL, or at > the carriage return if there's no more whitespace or semicolons, might > be the right thing to do at that point. I went ahead and added this, too. Please let me know if you think this is the right fix or if the second chunk isn't worth bothering with. Thanks, Nalin

--- php4/main/rfc1867.c.quotes Fri Jan 19 10:20:46 2001 +++ php4/main/rfc1867.c Fri Jan 19 10:22:52 2001 @@ -161,6 +161,9 @@ SAFE_RETURN; } loc = memchr(ptr, '\n', rem); + if(memchr(ptr, '\r', loc - ptr)) { + loc = memchr(ptr, '\r', loc - ptr); + } name = strstr(ptr, " name="); if (name && name < loc) { name += 6; @@ -172,6 +175,10 @@ php_error(E_WARNING, "File Upload Mime headers garbled name: [%c%c%c%c%c]", *name, *(name + 1), *(name + 2), *(name + 3), *(name + 4)); SAFE_RETURN; } + } else if(!s && memchr(name, ';', loc - name)) { + s = memchr(name, ';', loc - name); + } else if(!s && memchr(name, ' ', loc - name)) { + s = memchr(name, ' ', loc - name); } else if(!s) { s = loc; } else {