Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Commit 51aee38

Browse files
committed
Merge branch 'PHP-8.4'
* PHP-8.4: Fix GH-16998: UBSAN warning in rfc1867
2 parents b06f2bc + c06a1a4 commit 51aee38

File tree

2 files changed

+50
-1
lines changed

2 files changed

+50
-1
lines changed

‎main/rfc1867.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -319,8 +319,8 @@ static char *next_line(multipart_buffer *self)
319319
}
320320
/* return entire buffer as a partial line */
321321
line[self->bufsize] = 0;
322-
self->buf_begin = ptr;
323322
self->bytes_in_buffer = 0;
323+
/* Let fill_buffer() handle the reset of self->buf_begin */
324324
}
325325

326326
return line;

‎tests/basic/gh16998.phpt‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
--TEST--
2+
GH-16998 (UBSAN warning in rfc1867)
3+
--SKIPIF--
4+
<?php
5+
if (!getenv('TEST_PHP_CGI_EXECUTABLE')) {
6+
die("skip php-cgi not available");
7+
}
8+
?>
9+
--FILE--
10+
<?php
11+
const FILLUNIT = 5 * 1024;
12+
$cmd = [
13+
getenv('TEST_PHP_CGI_EXECUTABLE'),
14+
'-C',
15+
'-n',
16+
__DIR__ . '/GHSA-9pqp-7h25-4f32.inc',
17+
];
18+
$boundary = str_repeat('A', FILLUNIT);
19+
$body = ""
20+
. "--$boundary\r\n"
21+
. "Content-Disposition: form-data; name=\"koko\"\r\n"
22+
. "\r\n"
23+
. "BBB\r\n--" . substr($boundary, 0, -1) . "CCC\r\n"
24+
. "--$boundary--\r\n"
25+
;
26+
$env = array_merge($_ENV, [
27+
'REDIRECT_STATUS' => '1',
28+
'CONTENT_TYPE' => "multipart/form-data; boundary=",
29+
'CONTENT_LENGTH' => strlen($body),
30+
'REQUEST_METHOD' => 'POST',
31+
'SCRIPT_FILENAME' => __DIR__ . '/GHSA-9pqp-7h25-4f32.inc',
32+
]);
33+
$spec = [
34+
0 => ['pipe', 'r'],
35+
1 => STDOUT,
36+
2 => STDOUT,
37+
];
38+
$pipes = [];
39+
$handle = proc_open($cmd, $spec, $pipes, getcwd(), $env);
40+
fwrite($pipes[0], $body);
41+
proc_close($handle);
42+
?>
43+
--EXPECTF--
44+
X-Powered-By: PHP/%s
45+
Content-type: text/html; charset=UTF-8
46+
47+
Hello world
48+
array(0) {
49+
}

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /