ID:               34240
 Updated by:       [EMAIL PROTECTED]
 Reported By:      xuefer at 21cn dot com
-Status:           Assigned
+Status:           Closed
 Bug Type:         Zlib Related
 Operating System: *
 PHP Version:      5CVS, 6CVS, 4CVS (2005-08-25)
 Assigned To:      iliaa
 New Comment:

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.




Previous Comments:
------------------------------------------------------------------------

[2005-09-01 06:23:45] xuefer at 21cn dot com

i'd guess the "start_offset" is to avoid an extra erealloc. 
this bug should only happen when both do_start do_end is true
(do_end=true && start_offset!=0)

 /* {{{ php_do_deflate
@@ -717,7 +718,7 @@
 
    if (do_end) {
        err = deflate(&ZLIBG(stream), Z_FINISH);
-       buffer[outlen - ZLIBG(stream).avail_out] = '\0';
+       buffer[outlen + start_offset - ZLIBG(stream).avail_out] =
'\0';
    }

------------------------------------------------------------------------

[2005-09-01 03:00:57] [EMAIL PROTECTED]

I've tried to replicate the bug using given methodology and removing
the \0 line has absolutely no affect (md5 is the same) on the generated
output.

------------------------------------------------------------------------

[2005-08-31 14:39:15] xuefer at 21cn dot com

confirmed with ./configure --disable-all --disable-cli --with-zlib
both with cgi and fastcgi

good:
HTTP_ACCEPT_ENCODING=gzip php-cgi test.php |md5sum
826a819e34f7d57597d890de4176c265  -
bad:
HTTP_ACCEPT_ENCODING=gzip php-cgi test.php |md5sum
2e7dc64cd654b82f712b47b790dcbc12  -


(gdb) br 720
Breakpoint 2 at 0x805d6e5: file /home/xuefer/src/php4/ext/zlib/zlib.c,
line 720.
(gdb) r
#0  php_do_deflate (str_length=2, p_buffer=0xbffff028,
p_buffer_len=0xbffff02c, do_start=1 '\001', do_end=1 '\001')
    at /home/xuefer/src/php4/ext/zlib/zlib.c:720
(gdb) p outlen-zlib_globals.stream.avail_out
$8 = 10
(gdb) p buffer[outlen-zlib_globals.stream.avail_out]
$9 = 50 '2'
(gdb) step
724     *p_buffer = buffer;
(gdb) p buffer[outlen-zlib_globals.stream.avail_out]
$10 = 0 '\0'

the 2 is exactly what i see in httpwatch that get "lost" with the patch
applied

test result by php->lighttpd->httpwatch is at:
ftp://211.92.88.40/pub/phpbug/test.php.response.txt
ftp://211.92.88.40/pub/phpbug/test.php.response-corrupted.txt

------------------------------------------------------------------------

[2005-08-30 13:23:51] [EMAIL PROTECTED]

It doesn't make any difference with/without the patch for bug    #34191
(so I don't think it really broke anything)

Try with the shortest possible configure line:
# ./configure --disable-all --disable-cli --with-zlib


------------------------------------------------------------------------

[2005-08-24 21:14:51] [EMAIL PROTECTED]

Can you replicate in any other SAPI, I don't have fastcgi sapi 
installed anywhere.

------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
    http://bugs.php.net/34240

-- 
Edit this bug report at http://bugs.php.net/?id=34240&edit=1

Reply via email to