mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-24 10:24:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.4'

Browse Source 
* PHP-7.4:
  Fix #78876: Long variables cause OOM and temp files are not cleaned
  Fix #78875: Long filenames cause OOM and temp files are not cleaned
  Update NEWS for 7.2.31
  Update CREDITS for PHP 7.2.30
  Update NEWS for PHP 7.2.30
This commit is contained in:
Stanislav Malyshev 2020-05-11 14:21:25 -07:00
commit c317c420b0
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
main/rfc1867.c
View File

@ -604,7 +604,7 @@ static void *php_ap_memstr(char *haystack, int haystacklen, char *needle, int ne
}
/* read until a boundary condition */
static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
static size_t multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
{
size_t len, max;
char *bound;
@ -643,7 +643,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
self->buf_begin += len;
}
return (int)len;
return len;
}
/*
@ -653,7 +653,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
static char *multipart_buffer_read_body(multipart_buffer *self, size_t *len)
{
char buf[FILLUNIT], *out=NULL;
int total_bytes=0, read_bytes=0;
size_t total_bytes=0, read_bytes=0;
while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL))) {
out = erealloc(out, total_bytes + read_bytes + 1);
@ -680,7 +680,8 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL;
char *lbuf = NULL, *abuf = NULL;
zend_string *temp_filename = NULL;
int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0;
int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0;
size_t array_len = 0;
int64_t total_bytes = 0, max_file_size = 0;
int skip_upload = 0, anonindex = 0, is_anonymous;
HashTable *uploaded_files = NULL;
@ -1114,7 +1115,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
is_arr_upload = (start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');
if (is_arr_upload) {
array_len = (int)strlen(start_arr);
array_len = strlen(start_arr);
if (array_index) {
efree(array_index);
}