cvs: /php4/ext/standard head.c

thies Sun Feb 6 06:36:58 2000 EDT Modified files: /php4/ext/standard head.c Log: fix for #3413 @- Fixed possible buffer-overflow in setcookie(). (Thies) Index: php4/ext/standard/head.c diff -u php4/ext/standard/head.c:1.26 php4/ext/standard/head.c:1.27 --- php4/ext/standard/head.c:1.26 Fri Jan 28 05:31:12 2000 +++ php4/ext/standard/head.c Sun Feb 6 06:36:27 2000 @@ -15,7 +15,7 @@ | Authors: Rasmus Lerdorf <rasmus@lerdorf.on.ca> | +----------------------------------------------------------------------+ */ -/* $Id: head.c,v 1.26 2000/01/28 13:31:12 zeev Exp $ */ +/* $Id: head.c,v 1.27 2000/02/06 14:36:27 thies Exp $ */ #include <stdio.h> #include "php.h" @@ -242,10 +242,10 @@ /* php_set_cookie(name,value,expires,path,domain,secure) */ PHP_FUNCTION(setcookie) { - char *cookie; + char *cookie, *encoded_value = NULL; int len=sizeof("Set-Cookie: "); time_t t; - char *r, *dt; + char *dt; char *name = NULL, *value = NULL, *path = NULL, *domain = NULL; time_t expires = 0; int secure = 0; @@ -293,7 +293,8 @@ len += strlen(name); } if (value) { - len += strlen(value); + encoded_value = php_url_encode(value, strlen (value)); + len += strlen(encoded_value); } if (path) { len += strlen(path); @@ -316,9 +317,7 @@ efree(dt); } else { /* FIXME: XXX: this is not binary data safe */ - r = php_url_encode(value, strlen (value)); - sprintf(cookie, "Set-Cookie: %s=%s", name, value ? r : ""); - if (r) efree(r); + sprintf(cookie, "Set-Cookie: %s=%s", name, value ? encoded_value : ""); if (value) efree(value); value=NULL; if (name) efree(name); @@ -330,6 +329,9 @@ efree(dt); } } + + if (encoded_value) efree(encoded_value); + if (path && strlen(path)) { strcat(cookie, "; path="); strcat(cookie, path);