iliaa Thu Jul 27 17:14:24 2006 UTC
Modified files:
/php-src/main php_variables.c rfc1867.c
Log:
MFB: Fixed bug #38236 (Binary data gets corrupted on multipart/formdata
POST).
http://cvs.php.net/viewvc.cgi/php-src/main/php_variables.c?r1=1.127&r2=1.128&diff_format=u
Index: php-src/main/php_variables.c
diff -u php-src/main/php_variables.c:1.127 php-src/main/php_variables.c:1.128
--- php-src/main/php_variables.c:1.127 Wed May 3 11:24:51 2006
+++ php-src/main/php_variables.c Thu Jul 27 17:14:24 2006
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: php_variables.c,v 1.127 2006/05/03 11:24:51 dmitry Exp $ */
+/* $Id: php_variables.c,v 1.128 2006/07/27 17:14:24 iliaa Exp $ */
#include <stdio.h>
#include "php.h"
@@ -341,8 +341,7 @@
SAPI_API SAPI_POST_HANDLER_FUNC(php_std_post_handler)
{
- char *var, *val;
- char *strtok_buf = NULL;
+ char *var, *val, *e, *s, *p;
zval *array_ptr = (zval *) arg;
UConverter *input_conv = UG(http_input_encoding_conv);
@@ -354,11 +353,12 @@
input_conv = ZEND_U_CONVERTER(UG(output_encoding_conv));
}
- var = php_strtok_r(SG(request_info).post_data, "&", &strtok_buf);
+ s = SG(request_info).post_data;
+ e = s + SG(request_info).post_data_length;
- while (var) {
- val = strchr(var, '=');
- if (val) { /* have a value */
+ while (s < e && (p = memchr(s, '&', (e - s)))) {
+last_value:
+ if ((val = memchr(s, '=', (p - s)))) { /* have a value */
if (UG(unicode)) {
UChar *u_var, *u_val;
int u_var_len, u_val_len;
@@ -366,10 +366,12 @@
int val_len;
UErrorCode status1 = U_ZERO_ERROR, status2 =
U_ZERO_ERROR;
- *val++ = '\0';
- var_len = strlen(var);
+ var = s;
+ var_len = val - s;
+
php_url_decode(var, var_len);
- val_len = php_url_decode(val, strlen(val));
+ val++;
+ val_len = php_url_decode(val, (p - val));
zend_convert_to_unicode(input_conv, &u_var,
&u_var_len, var, var_len, &status1);
zend_convert_to_unicode(input_conv, &u_val,
&u_val_len, val, val_len, &status2);
if (U_SUCCESS(status1) && U_SUCCESS(status2)) {
@@ -383,9 +385,11 @@
} else {
unsigned int val_len, new_val_len;
- *val++ = '\0';
- php_url_decode(var, strlen(var));
- val_len = php_url_decode(val, strlen(val));
+ var = s;
+
+ php_url_decode(var, (val - s));
+ val++;
+ val_len = php_url_decode(val, (p - val));
val = estrndup(val, val_len);
if (sapi_module.input_filter(PARSE_POST, var,
&val, val_len, &new_val_len TSRMLS_CC)) {
php_register_variable_safe(var, val,
new_val_len, array_ptr TSRMLS_CC);
@@ -393,7 +397,11 @@
efree(val);
}
}
- var = php_strtok_r(NULL, "&", &strtok_buf);
+ s = p + 1;
+ }
+ if (s < e) {
+ p = e;
+ goto last_value;
}
}
http://cvs.php.net/viewvc.cgi/php-src/main/rfc1867.c?r1=1.186&r2=1.187&diff_format=u
Index: php-src/main/rfc1867.c
diff -u php-src/main/rfc1867.c:1.186 php-src/main/rfc1867.c:1.187
--- php-src/main/rfc1867.c:1.186 Thu Jul 13 12:17:25 2006
+++ php-src/main/rfc1867.c Thu Jul 27 17:14:24 2006
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: rfc1867.c,v 1.186 2006/07/13 12:17:25 tony2001 Exp $ */
+/* $Id: rfc1867.c,v 1.187 2006/07/27 17:14:24 iliaa Exp $ */
/*
* This product includes software developed by the Apache Group
@@ -50,7 +50,7 @@
#if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
#include "ext/mbstring/mbstring.h"
-static void safe_php_register_variable(char *var, char *strval, zval
*track_vars_array, zend_bool override_protection TSRMLS_DC);
+static void safe_php_register_variable(char *var, char *strval, int val_len,
zval *track_vars_array, zend_bool override_protection TSRMLS_DC);
void php_mb_flush_gpc_variables(int num_vars, char **val_list, int *len_list,
zval *array_ptr TSRMLS_DC)
{
@@ -61,7 +61,7 @@
php_mb_gpc_encoding_converter(val_list, len_list,
num_vars, NULL, NULL TSRMLS_CC);
}
for (i=0; i<num_vars; i+=2){
- safe_php_register_variable(val_list[i], val_list[i+1],
array_ptr, 0 TSRMLS_CC);
+ safe_php_register_variable(val_list[i], val_list[i+1],
len_list[i+1], array_ptr, 0 TSRMLS_CC);
efree(val_list[i]);
efree(val_list[i+1]);
}
@@ -282,10 +282,10 @@
}
-static void safe_php_register_variable(char *var, char *strval, zval
*track_vars_array, zend_bool override_protection TSRMLS_DC)
+static void safe_php_register_variable(char *var, char *strval, int val_len,
zval *track_vars_array, zend_bool override_protection TSRMLS_DC)
{
if (override_protection || !is_protected_variable(var TSRMLS_CC)) {
- php_register_variable(var, strval, track_vars_array TSRMLS_CC);
+ php_register_variable_safe(var, strval, val_len,
track_vars_array TSRMLS_CC);
}
}
@@ -316,7 +316,7 @@
static void register_http_post_files_variable(char *strvar, char *val, zval
*http_post_files, zend_bool override_protection TSRMLS_DC)
{
- safe_php_register_variable(strvar, val, http_post_files,
override_protection TSRMLS_CC);
+ safe_php_register_variable(strvar, val, strlen(val), http_post_files,
override_protection TSRMLS_CC);
}
@@ -980,7 +980,7 @@
XXX: this is horrible memory-usage-wise, but we only expect
to do this on small pieces of form data.
*/
-static char *multipart_buffer_read_body(multipart_buffer *self TSRMLS_DC)
+static char *multipart_buffer_read_body(multipart_buffer *self, unsigned int
*len TSRMLS_DC)
{
char buf[FILLUNIT], *out=NULL;
int total_bytes=0, read_bytes=0;
@@ -992,6 +992,7 @@
}
if (out) out[total_bytes] = '\0';
+ *len = total_bytes;
return out;
}
@@ -1142,14 +1143,15 @@
if (!filename && param) {
UChar *u_val;
int32_t u_val_len;
+ unsigned int value_len;
UErrorCode status = U_ZERO_ERROR;
- char *value = multipart_buffer_read_body(mbuff
TSRMLS_CC);
+ char *value = multipart_buffer_read_body(mbuff,
&value_len TSRMLS_CC);
/* unsigned int new_val_len; Dummy variable */
if (value) {
/* UTODO use 'charset' parameter for
conversion */
- zend_convert_to_unicode(input_conv,
&u_val, &u_val_len, value, strlen(value), &status);
+ zend_convert_to_unicode(input_conv,
&u_val, &u_val_len, value, value_len, &status);
if (U_FAILURE(status)) {
/* UTODO set a user-accessible
flag to indicate that conversion failed? */
goto var_done;
@@ -1597,24 +1599,24 @@
/* Normal form variable, safe to read all data into
memory */
if (!filename && param) {
-
- char *value = multipart_buffer_read_body(mbuff
TSRMLS_CC);
+ unsigned int value_len;
+ char *value = multipart_buffer_read_body(mbuff,
&value_len TSRMLS_CC);
unsigned int new_val_len; /* Dummy variable */
if (!value) {
value = estrdup("");
}
- if (sapi_module.input_filter(PARSE_POST, param,
&value, strlen(value), &new_val_len TSRMLS_CC)) {
+ if (sapi_module.input_filter(PARSE_POST, param,
&value, value_len, &new_val_len TSRMLS_CC)) {
#if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
if
(php_mb_encoding_translation(TSRMLS_C)) {
php_mb_gpc_stack_variable(param, value, &val_list, &len_list,
&num_vars, &num_vars_max TSRMLS_CC);
} else {
-
safe_php_register_variable(param, value, array_ptr, 0 TSRMLS_CC);
+
safe_php_register_variable(param, value, value_len, array_ptr, 0 TSRMLS_CC);
}
#else
- safe_php_register_variable(param,
value, array_ptr, 0 TSRMLS_CC);
+ safe_php_register_variable(param,
value, value_len, array_ptr, 0 TSRMLS_CC);
#endif
}
if (!strcasecmp(param, "MAX_FILE_SIZE")) {
@@ -1814,9 +1816,9 @@
if (!is_anonymous) {
if (s && s > filename) {
- safe_php_register_variable(lbuf, s+1,
NULL, 0 TSRMLS_CC);
+ safe_php_register_variable(lbuf, s+1,
strlen(s+1), NULL, 0 TSRMLS_CC);
} else {
- safe_php_register_variable(lbuf,
filename, NULL, 0 TSRMLS_CC);
+ safe_php_register_variable(lbuf,
filename, strlen(filename), NULL, 0 TSRMLS_CC);
}
}
@@ -1852,7 +1854,7 @@
sprintf(lbuf, "%s_type", param);
}
if (!is_anonymous) {
- safe_php_register_variable(lbuf, cd, NULL, 0
TSRMLS_CC);
+ safe_php_register_variable(lbuf, cd,
strlen(cd), NULL, 0 TSRMLS_CC);
}
/* Add $foo[type] */
@@ -1874,7 +1876,7 @@
/* if param is of form xxx[.*] this will cut it to xxx
*/
if (!is_anonymous) {
- safe_php_register_variable(param,
temp_filename, NULL, 1 TSRMLS_CC);
+ safe_php_register_variable(param,
temp_filename, strlen(temp_filename), NULL, 1 TSRMLS_CC);
}
/* Add $foo[tmp_name] */
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
