Fixed bug #69364 - use smart_str to assemble strings

This commit is contained in:
Stanislav Malyshev 2015-05-09 23:04:25 -07:00
parent c27f012b7a
commit 4605d536d2

View file

@ -33,6 +33,7 @@
#include "php_variables.h" #include "php_variables.h"
#include "rfc1867.h" #include "rfc1867.h"
#include "ext/standard/php_string.h" #include "ext/standard/php_string.h"
#include "ext/standard/php_smart_str.h"
#define DEBUG_FILE_UPLOAD ZEND_DEBUG #define DEBUG_FILE_UPLOAD ZEND_DEBUG
@ -398,8 +399,9 @@ static int find_boundary(multipart_buffer *self, char *boundary TSRMLS_DC)
static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header TSRMLS_DC) static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header TSRMLS_DC)
{ {
char *line; char *line;
mime_header_entry prev_entry = {0}, entry; mime_header_entry entry = {0};
int prev_len, cur_len; smart_str buf_value = {0};
char *key = NULL;
/* didn't find boundary, abort */ /* didn't find boundary, abort */
if (!find_boundary(self, self->boundary TSRMLS_CC)) { if (!find_boundary(self, self->boundary TSRMLS_CC)) {
@ -411,11 +413,10 @@ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header T
while( (line = get_line(self TSRMLS_CC)) && strlen(line) > 0 ) while( (line = get_line(self TSRMLS_CC)) && strlen(line) > 0 )
{ {
/* add header to table */ /* add header to table */
char *key = line;
char *value = NULL; char *value = NULL;
if (php_rfc1867_encoding_translation(TSRMLS_C)) { if (php_rfc1867_encoding_translation(TSRMLS_C)) {
self->input_encoding = zend_multibyte_encoding_detector(line, strlen(line), self->detect_order, self->detect_order_size TSRMLS_CC); self->input_encoding = zend_multibyte_encoding_detector((unsigned char *)line, strlen(line), self->detect_order, self->detect_order_size TSRMLS_CC);
} }
/* space in the beginning means same header */ /* space in the beginning means same header */
@ -424,31 +425,33 @@ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header T
} }
if (value) { if (value) {
*value = 0; if(buf_value.c && key) {
/* new entry, add the old one to the list */
smart_str_0(&buf_value);
entry.key = key;
entry.value = buf_value.c;
zend_llist_add_element(header, &entry);
buf_value.c = NULL;
key = NULL;
}
*value = '\0';
do { value++; } while(isspace(*value)); do { value++; } while(isspace(*value));
entry.value = estrdup(value); key = estrdup(line);
entry.key = estrdup(key); smart_str_appends(&buf_value, value);
} else if (buf_value.c) { /* If no ':' on the line, add to previous line */
} else if (zend_llist_count(header)) { /* If no ':' on the line, add to previous line */ smart_str_appends(&buf_value, line);
prev_len = strlen(prev_entry.value);
cur_len = strlen(line);
entry.value = emalloc(prev_len + cur_len + 1);
memcpy(entry.value, prev_entry.value, prev_len);
memcpy(entry.value + prev_len, line, cur_len);
entry.value[cur_len + prev_len] = '\0';
entry.key = estrdup(prev_entry.key);
zend_llist_remove_tail(header);
} else { } else {
continue; continue;
} }
}
if(buf_value.c && key) {
/* add the last one to the list */
smart_str_0(&buf_value);
entry.key = key;
entry.value = buf_value.c;
zend_llist_add_element(header, &entry); zend_llist_add_element(header, &entry);
prev_entry = entry;
} }
return 1; return 1;
@ -884,7 +887,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
if (count == PG(max_input_vars) + 1) { if (count == PG(max_input_vars) + 1) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars)); php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars));
} }
if (php_rfc1867_callback != NULL) { if (php_rfc1867_callback != NULL) {
multipart_event_formdata event_formdata; multipart_event_formdata event_formdata;