archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-7.3' into PHP-7.4

Browse source 
* PHP-7.3:
  Fix #78876: Long variables cause OOM and temp files are not cleaned
  Fix #78875: Long filenames cause OOM and temp files are not cleaned
  Update NEWS for 7.2.31
  Update CREDITS for PHP 7.2.30
  Update NEWS for PHP 7.2.30
This commit is contained in:
Stanislav Malyshev 2020-05-11 14:20:47 -07:00
commit 355e36e4f6
1 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
main/rfc1867.c
View file

@ -606,7 +606,7 @@ static void *php_ap_memstr(char *haystack, int haystacklen, char *needle, int ne
} }
/* read until a boundary condition */ /* read until a boundary condition */
static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end) static size_t multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
{ {
size_t len, max; size_t len, max;
char *bound; char *bound;
@ -645,7 +645,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
self->buf_begin += len; self->buf_begin += len;
} }
return (int)len; return len;
} }
/* /*
@ -655,7 +655,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
static char *multipart_buffer_read_body(multipart_buffer *self, size_t *len) static char *multipart_buffer_read_body(multipart_buffer *self, size_t *len)
{ {
char buf[FILLUNIT], *out=NULL; char buf[FILLUNIT], *out=NULL;
int total_bytes=0, read_bytes=0; size_t total_bytes=0, read_bytes=0;
while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL))) { while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL))) {
out = erealloc(out, total_bytes + read_bytes + 1); out = erealloc(out, total_bytes + read_bytes + 1);
@ -682,7 +682,8 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL; char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL;
char *lbuf = NULL, *abuf = NULL; char *lbuf = NULL, *abuf = NULL;
zend_string *temp_filename = NULL; zend_string *temp_filename = NULL;
int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0; int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0;
size_t array_len = 0;
int64_t total_bytes = 0, max_file_size = 0; int64_t total_bytes = 0, max_file_size = 0;
int skip_upload = 0, anonindex = 0, is_anonymous; int skip_upload = 0, anonindex = 0, is_anonymous;
HashTable *uploaded_files = NULL; HashTable *uploaded_files = NULL;
@ -1116,7 +1117,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
is_arr_upload = (start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']'); is_arr_upload = (start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');
if (is_arr_upload) { if (is_arr_upload) {
array_len = (int)strlen(start_arr); array_len = strlen(start_arr);
if (array_index) { if (array_index) {
efree(array_index); efree(array_index);
} }