ID: 49286
User updated by: jost_boekemeier at users dot sf dot net
Reported By: jost_boekemeier at users dot sf dot net
-Status: Feedback
+Status: Open
Bug Type: Filesystem function related
Operating System: *
PHP Version: 5.2.5
New Comment:
Hi,
I have pasted a conversion from the php java bridge mailing list.
Please re-read the ticket, the problematic line and a possible fix is
there.
> simple fopen("php://input","r"); certainly does NOT crash in PHP_5_2
o
Hrm. Please read the ticket again. A function which doesn't read
anything but which
increments the global read counter so that the cgi sapi shutdown
calculates false read
values certainly contains a bug.
Previous Comments:
------------------------------------------------------------------------
[2009-08-18 15:10:47] [email protected]
Who are you talking to? Where's the reproduce code that crashes? (fyi:
simple fopen("php://input","r"); certainly does NOT crash in PHP_5_2 or
PHP_5_3 or HEAD right now.
------------------------------------------------------------------------
[2009-08-18 12:03:18] jost_boekemeier at users dot sf dot net
Description:
------------
You are right, when calling fopen("php://input", "r") PHP version 5 may
crash or hang. Please do not use it until this PHP5 bug is fixed.
I have looked at php 5.2.5. In php_fopen_wrapper.c line 81 it reads the
raw_post_data and then increments the SG(read_post_bytes) even though it
hasn't read anything. The result is that SG(read_post_bytes) is twice
the CONTENT_LENGTH size, causing all sorts of strage side effects later
on.
Reproduce code:
---------------
Current code from
http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php_fopen_wrapper.c?revision=276986&view=markup
if(SG(request_info).raw_post_data) { /* data has already been read by a
post handler */
read_bytes = SG(request_info).raw_post_data_length - *position;
...
SG(read_post_bytes) += read_bytes;
Suggested fix; make read_bytes a local var:
size_t read_bytes = SG(request_info).raw_post_data_length - *position;
^^^^^^^
Expected result:
----------------
SG(read_post_bytes) == CONTENT_LENGTH
Actual result:
--------------
SG(read_post_bytes) 2 times CONTENT_LENGTH
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=49286&edit=1
