Bug #13413 Updated: Seg Fault when urlencoding a binary string
| From: | derick@php.net | Date: | Sat, 20 Oct 2001 10:58:55 +0000 |
| Subject: | Bug #13413 Updated: Seg Fault when urlencoding a binary string | ||
| References: | 1 | Groups: | php.dev |
| Request: | Send a blank email to php-dev+get-68494@lists.php.net to get a copy of this message | ||
ID: 13413
Updated by: derick
Reported By: php@manuel.mailshell.com
Old Status: Assigned
Status: Closed
Bug Type: Strings related
Operating System: Linux 2.4
PHP Version: 4.0.6
Old Assigned To: derick
Assigned To:
New Comment:
Fixed in CVS
Previous Comments:
------------------------------------------------------------------------
[2001-10-20 06:00:04] sander@php.net
Reproduced on Win2K (PHP-4.1.0RC1, Apache 1.3.22, it simply crashes) and Debian Linux (PHP-4.0.6 on
Apache 1.3.20, segfaults in error_log).
Marking as critical.
------------------------------------------------------------------------
[2001-09-24 06:23:21] php@manuel.mailshell.com
If we pass a binary string which contains a byte with
an ASCII value of "0" to urlencode, then PHP will segfault.
This short script will demonstrate the problem. Notice
that I am using urldecode because I have no way
of printing an ascii value of 0.
<?
$initString = "%00an%3E";
$binaryString = urldecode($initString);
$encodedString = urlencode($binaryString);
?>
I believe the problem is in file ../ext/standard/url.c
and in function php_url_encode(). This function uses
allocates memory for the new string after determining
the length of the input string via strlen(). However, a
binary string could contain a byte with a value of zero,
thereby yielding a shorter string length and not enough
memory allocated.
I'll also include a suggested patch below.
--- ext/standard/url.c.orig Mon Sep 24 02:53:54 2001
+++ ext/standard/url.c Mon Sep 24 02:53:38 2001
@@ -239,7 +239,7 @@
{
register int x, y;
unsigned char *str;
- str = (unsigned char *) emalloc(3 * strlen(s) + 1);
+ str = (unsigned char *) emalloc(3 * len + 1);
for (x = 0, y = 0; len--; x++, y++) {
str[y] = (unsigned char) s[x];
if (str[y] == ' ') {
P.S. Thanks for working on PHP, it's a fantastic language
and I appreciate your effort.
-Manuel
------------------------------------------------------------------------
Edit this bug report at http://bugs.php.net/?id=13413&edit=1