From: jost_boekemeier at users dot sf dot net
Operating system: any
PHP version: 5.2.10
PHP Bug Type: Unknown/Other Function
Bug description: php://input (php_stream_input_read) is broken
Description:
------------
You are right, when calling fopen("php://input", "r") PHP version 5 may
crash or hang. Please do not use it until this PHP5 bug is fixed.
I have looked at php 5.2.5. In php_fopen_wrapper.c line 81 it reads the
raw_post_data and then increments the SG(read_post_bytes) even though it
hasn't read anything. The result is that SG(read_post_bytes) is twice the
CONTENT_LENGTH size, causing all sorts of strage side effects later on.
Reproduce code:
---------------
Current code from
http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php_fopen_wrapper.c?revision=276986&view=markup
if(SG(request_info).raw_post_data) { /* data has already been read by a
post handler */
read_bytes = SG(request_info).raw_post_data_length - *position;
...
SG(read_post_bytes) += read_bytes;
Suggested fix; make read_bytes a local var:
size_t read_bytes = SG(request_info).raw_post_data_length - *position;
^^^^^^^
Expected result:
----------------
SG(read_post_bytes) == CONTENT_LENGTH
Actual result:
--------------
SG(read_post_bytes) 2 times CONTENT_LENGTH
--
Edit bug report at http://bugs.php.net/?id=49286&edit=1
--
Try a snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=49286&r=trysnapshot52
Try a snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=49286&r=trysnapshot53
Try a snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=49286&r=trysnapshot60
Fixed in SVN:
http://bugs.php.net/fix.php?id=49286&r=fixed
Fixed in SVN and need be documented:
http://bugs.php.net/fix.php?id=49286&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=49286&r=alreadyfixed
Need backtrace:
http://bugs.php.net/fix.php?id=49286&r=needtrace
Need Reproduce Script:
http://bugs.php.net/fix.php?id=49286&r=needscript
Try newer version:
http://bugs.php.net/fix.php?id=49286&r=oldversion
Not developer issue:
http://bugs.php.net/fix.php?id=49286&r=support
Expected behavior:
http://bugs.php.net/fix.php?id=49286&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=49286&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=49286&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=49286&r=globals
PHP 4 support discontinued: http://bugs.php.net/fix.php?id=49286&r=php4
Daylight Savings: http://bugs.php.net/fix.php?id=49286&r=dst
IIS Stability:
http://bugs.php.net/fix.php?id=49286&r=isapi
Install GNU Sed:
http://bugs.php.net/fix.php?id=49286&r=gnused
Floating point limitations:
http://bugs.php.net/fix.php?id=49286&r=float
No Zend Extensions:
http://bugs.php.net/fix.php?id=49286&r=nozend
MySQL Configuration Error:
http://bugs.php.net/fix.php?id=49286&r=mysqlcfg
