mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-12-01 13:54:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

- MFH Handle corrupt base64 data in data: url

Browse Source
This commit is contained in:
Marcus Boerger 2006-05-21 13:37:19 +00:00
parent abcee63635
commit e145343b57
2 changed files with 46 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
ext/standard/tests/file/stream_rfc2397_006.phpt Executable file
View File

@ -0,0 +1,28 @@
--TEST--
Stream: RFC2397 with corrupt? payload
--FILE--
<?php
$streams = array(
"data:;base64,\0Zm9vYmFyIGZvb2Jhcg==",
"data:;base64,Zm9vYmFy\0IGZvb2Jhcg==",
'data:;base64,#Zm9vYmFyIGZvb2Jhcg==',
'data:;base64,#Zm9vYmFyIGZvb2Jhc=',
);
foreach($streams as $stream)
{
var_dump(file_get_contents($stream));
}
?>
===DONE===
<?php exit(0); ?>
--EXPECTF--
string(0) ""
string(6) "foobar"
string(13) "foobar foobar"
Warning: file_get_contents(data:;base64,#Zm9vYmFyIGZvb2Jhc=): failed to open stream: rfc2397: unable to decode in %sstream_rfc2397_006.php on line %d
bool(false)
===DONE===

32
main/streams/memory.c
View File

@ -652,21 +652,25 @@ static php_stream * php_stream_url_wrap_rfc2397(php_stream_wrapper *wrapper, cha
}
add_assoc_bool(meta, "base64", base64);
if ((stream = php_stream_temp_create_rel(0, ~0u)) != NULL) {
/* skip ',' */
comma++;
dlen--;
/* store data */
if (base64) {
comma = (char*)php_base64_decode((const unsigned char *)comma, dlen, &ilen);
php_stream_temp_write(stream, comma, ilen TSRMLS_CC);
efree(comma);
} else {
comma = estrndup(comma, dlen);
dlen = php_url_decode(comma, dlen);
php_stream_temp_write(stream, comma, dlen TSRMLS_CC);
efree(comma);
/* skip ',' */
comma++;
dlen--;
if (base64) {
comma = (char*)php_base64_decode((const unsigned char *)comma, dlen, &ilen);
if (!comma) {
php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "rfc2397: unable to decode");
return NULL;
}
} else {
comma = estrndup(comma, dlen);
ilen = dlen = php_url_decode(comma, dlen);
}
if ((stream = php_stream_temp_create_rel(0, ~0u)) != NULL) {
/* store data */
php_stream_temp_write(stream, comma, ilen TSRMLS_CC);
efree(comma);
php_stream_temp_seek(stream, 0, SEEK_SET, &newoffs TSRMLS_CC);
/* set special stream stuff (enforce exact mode) */
vlen = strlen(mode);