From: cvitale at us dot ibm dot com Operating system: Linux 2.4 PHP version: 5.2.3 PHP Bug Type: Apache2 related Bug description: PHP drops APR_EGENERAL from ap_get_brigade
Description: ------------ I've compiled php to run on Apache 2.0.59 with --with-apxs2. The function php_apache_sapi_read_post in php-5.2.3/sapi/apache2handler/sapi_apache2.c assumes that the call to ap_get_brigade will never return an error that php should give to Apache. This violates Apache best practices. An Apache2 input content filter may return an error, like APR_EGENERAL. I am working on a filter that will reject suspicious input content and return this value. I also set the Apache request_rec status to 403. The requests that are returned have a 403 Forbidden status header and the normal php output body content. If ap_get_brigade returns an apache error php should stop processing. -- Edit bug report at http://bugs.php.net/?id=42404&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=42404&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=42404&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=42404&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=42404&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=42404&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=42404&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=42404&r=needscript Try newer version: http://bugs.php.net/fix.php?id=42404&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=42404&r=support Expected behavior: http://bugs.php.net/fix.php?id=42404&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=42404&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=42404&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=42404&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=42404&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=42404&r=dst IIS Stability: http://bugs.php.net/fix.php?id=42404&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=42404&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=42404&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=42404&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=42404&r=mysqlcfg
