Bug #11998 Updated: Crash on multipart file form upload

ID: 11998 Updated by: sniper Reported By: me@philth.net.nz Old Status: Critical Status: Closed Bug Type: Reproducible crash Operating System: FreeBSD 4.2-STABLE PHP Version: 4.0CVS-2001-07-10 New Comment: This is fixed now. --Jani Previous Comments: ------------------------------------------------------------------------ [2001-08-30 14:22:59] troels@php.net Some follow-up. PHP 4.0.5 does _not_ have the bug. Current CVS (August 30 2001) does have the bug. The bug doesn't seem to show up unless around 30 files are uploaded. Here's a back-trace from PHP current CVS. #0 php_mime_split ( buf=0x80fbaf4 '-' <repeats 29 times>, "172461271845611381008674657\r\nContent-Disposition: form-data; name=\"date_debut\"\r\n\r\n2001-08-25", cnt=28292, boundary=0x80c387a '-' <repeats 27 times>, "172461271845611381008674657", array_ptr=0x80fb0e4) at rfc1867.c:177 #1 0x4042a55f in rfc1867_post_handler ( content_type_dup=0x80c385c "multipart/form-data; boundary=", '-' <repeats 27 times>, "172461271845611381008674657", arg=0x80fb0e4) at rfc1867.c:472 #2 0x40427c83 in sapi_handle_post (arg=0x80fb0e4) at SAPI.c:107 #3 0x4042b768 in php_treat_data (arg=0, str=0x0, destArray=0x0) at php_variables.c:250 #4 0x40425036 in php_hash_environment () at main.c:1097 #5 0x404244d0 in php_request_startup () at main.c:684 #6 0x404216c0 in apache_php_module_main (r=0x80e5218, display_source_mode=0) at sapi_apache.c:67 #7 0x40422324 in send_php (r=0x80e5218, display_source_mode=0, filename=0x0) at mod_php4.c:575 #8 0x40422383 in send_parsed_php (r=0x80e5218) at mod_php4.c:590 #9 0x080551cd in ap_invoke_handler () at eval.c:41 #10 0x0806732c in ap_some_auth_required () at eval.c:41 #11 0x080673a3 in ap_process_request () at eval.c:41 #12 0x0805fa47 in ap_child_terminate () at eval.c:41 #13 0x0805fbea in ap_child_terminate () at eval.c:41 #14 0x0805fd2d in ap_child_terminate () at eval.c:41 #15 0x08060350 in ap_child_terminate () at eval.c:41 #16 0x08060c13 in main () at eval.c:41 #17 0x4015c4b7 in __libc_start_main (main=0x8060790 <main>, argc=2, ubp_av=0xbffff9c4, init=0x804fb20 <_init>, fini=0x80894d0 <_fini>, rtld_fini=0x4000dbb4 <_dl_fini>, stack_end=0xbffff9bc) at ../sysdeps/generic/libc-start.c:129 ------------------------------------------------------------------------ [2001-08-30 13:32:38] troels@php.net The bug also exists when running PHP on Linux. And it may be reproduced with Mozilla, too. Please don't forget this one before 4.0.7 is released. ------------------------------------------------------------------------ [2001-08-23 05:54:35] sniper@php.net Reproduced with IE 5.5. The rfc1867.c has some bugs in it after all.. Marked as fix before release. (4.0.7) --Jani ------------------------------------------------------------------------ [2001-08-21 05:42:02] me@philth.net.nz Crashes with 1.3.14, 1.3.17 and 1.3.20. I've tried it with IE5, IE5.5, Mozilla 0.9.3 and Netscape 6.1. Whoa, just found it _doesn't_ crash with Netscape 4.08 or Opera 5.11. I can't test it in Linux, as I'm currently sans-external-DSL-modem and therefore stuck in windows until a new one arrives. ------------------------------------------------------------------------ [2001-08-21 05:28:51] sniper@php.net Just one more thing: What version of Apache? And does this happen with any browser? IE / NS / Mozilla ? --Jani ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/?id=11998 Edit this bug report at http://bugs.php.net/?id=11998&edit=1