ID: 49286
Updated by: [email protected]
Reported By: jost_boekemeier at users dot sf dot net
-Status: Open
+Status: Feedback
-Bug Type: Unknown/Other Function
+Bug Type: Filesystem function related
Operating System: *
-PHP Version: 5.2.10
+PHP Version: 5.2.5
New Comment:
Who are you talking to? Where's the reproduce code that crashes? (fyi:
simple fopen("php://input","r"); certainly does NOT crash in PHP_5_2 or
PHP_5_3 or HEAD right now.
Previous Comments:
------------------------------------------------------------------------
[2009-08-18 12:03:18] jost_boekemeier at users dot sf dot net
Description:
------------
You are right, when calling fopen("php://input", "r") PHP version 5 may
crash or hang. Please do not use it until this PHP5 bug is fixed.
I have looked at php 5.2.5. In php_fopen_wrapper.c line 81 it reads the
raw_post_data and then increments the SG(read_post_bytes) even though it
hasn't read anything. The result is that SG(read_post_bytes) is twice
the CONTENT_LENGTH size, causing all sorts of strage side effects later
on.
Reproduce code:
---------------
Current code from
http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php_fopen_wrapper.c?revision=276986&view=markup
if(SG(request_info).raw_post_data) { /* data has already been read by a
post handler */
read_bytes = SG(request_info).raw_post_data_length - *position;
...
SG(read_post_bytes) += read_bytes;
Suggested fix; make read_bytes a local var:
size_t read_bytes = SG(request_info).raw_post_data_length - *position;
^^^^^^^
Expected result:
----------------
SG(read_post_bytes) == CONTENT_LENGTH
Actual result:
--------------
SG(read_post_bytes) 2 times CONTENT_LENGTH
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=49286&edit=1
