PHP 4.0 Bug #9298: HTTP File upload, Content-Type header is stored at the beginning of the file

From: martinw@bluecho.com Operating system: RedHat Linux 7.0 PHP version: 4.0.4pl1 PHP Bug Type: HTTP related Bug description: HTTP File upload, Content-Type header is stored at the beginning of the file For an example, using the following form <html> <head> <title>Upload Test</title> </head> <body> <form action="uploadtest.php" method="post" enctype="multipart/form-data"> <input type="file" name="uploadedfile"> <input type="submit" value="Upload"> </form> </body> </html> and uploading a file, gives me a variable $uploadedfile with the name of the temp. file on the server. This file will have something like: Content-Type: application/octet-stream or Content-Type: image/jpeg pre-pended to the file's data. I've been copying the good data out of the file by fgets()ing the first two lines, then looping through the rest of the file with fread() and fwrite()ing the data into a new file. The following example shows the two header lines being removed, and the file(1) command confirming their contents: <head> <title>Upload test</title> </head> <body> <?php // What type is the uploaded file? echo file $uploadedfile."<br>\n"; // Open the file for the copy $infile=fopen($uploadedfile,"r"); $outfile=fopen("$uploadedfile.new","w"); // Pull out the Content-Type header, and the empty // line $header=fgets($infile,255); echo "header: $header<br>\n"; $header=fgets($infile,255); echo "empty line: $header<br>\n"; // Loop through the remaining file while(!feof($infile)) { $temp=fread($infile,128); fwrite($outfile,$temp,strlen($temp)); } fclose($outfile); fclose($infile); // Test the type of the new file echo file $uploadedfile.new."<br>\n"; // Test done - delete the file we made unlink("$uploadedfile.new"); ?> </body> </html> This gives me output like the following: /tmp/phpU7s9yh: image/gif header: Content-Type: image/gif empty line: /tmp/phpU7s9yh.new: GIF image data, version 89a, 100 x 30, or /tmp/phpaWEhbG: application/octet-stream header: Content-Type: application/octet-stream empty line: /tmp/phpaWEhbG.new: MS-DOS executable (EXE), OS/2 or MS Windows I'm getting this problem using the PHP package compiled by RedHat (php-4.0.4pl1-3.i386.rpm and associated packages). The configure command reported by phpinfo() is: './configure' '--prefix=/usr' '--with-config-file-path=/etc' '--disable-debug' '--enable-pic' '--enable-shared' '--enable-inline-optimization' '--with-apxs=/usr/sbin/apxs' '--with-exec-dir=/usr/bin' '--with-regex=system' '--with-gettext' '--with-gd' '--with-jpeg-dir=/usr' '--with-png' '--with-zlib' '--with-db2' '--with-db3' '--with-gdbm' '--enable-debugger' '--enable-magic-quotes' '--enable-safe-mode' '--enable-sockets' '--enable-sysvsem' '--enable-sysvshm' '--enable-track-vars' '--enable-yp' '--enable-ftp' '--enable-wddx' '--without-mysql' '--without-oracle' '--without-oci8' '--with-xml' -- Edit Bug report at: http://bugs.php.net/?id=9298&edit=1