ID: 22657
Updated by: [EMAIL PROTECTED]
Reported By: vesely at tana dot it
Status: Bogus
Bug Type: HTTP related
Operating System: Any
PHP Version: 4.3.0
New Comment:
It must not be tested for not being NULL because
it is only NULL while self->bytes_in_buffer is
0. There will be no action on it until bytes_in_buffer
becomes > 0. This only happens after the buf begin
is set to the buffer again...
Previous Comments:
------------------------------------------------------------------------
[2003-03-13 01:13:01] vesely at tana dot it
> buf_begin can be NULL, no DOS possible -> BOGUS1
it is not initialized to NULL, it is never tested for not
being NULL, and around line 232, function fill_buffer
if (self->bytes_in_buffer > 0 && self->buf_begin != self->buffer) {
memmove(self->buffer, self->buf_begin, self->bytes_in_buffer);
}
should grant the job will be done. Why do you say
it can be NULL? If I have some more time next week
I'll try and prepare a proof of concept.
> searching for ',' is correct this works around a bug
> in some IE version -> BOGUS2
Ha ha! I should have guessed it... :-)
------------------------------------------------------------------------
[2003-03-12 16:06:33] [EMAIL PROTECTED]
buf_begin can be NULL, no DOS possible -> BOGUS1
searching for ',' is correct this works around a bug
in some IE version -> BOGUS2
------------------------------------------------------------------------
[2003-03-12 03:44:37] vesely at tana dot it
Hi,
watch out rfc1867.c around line 342, in function
next_line() there is (was?) the following code:
if (ptr) {
/* ... */
} else {
/* ... */
line[self->bufsize] = 0;
self->buf_begin = ptr; /* <=== */
self->bytes_in_buffer = 0;
}
ptr is obviously NULL, buf_begin should never be NULL
or the program may crash. So this is a potential
vulnerability for DOS attackers who submit long lines.
Since you're there, would you mind to check why at line
721, in the rfc1867_post_handler function, there is
boundary_end = strchr(boundary, ',');
Shouldn't it be ';' (semicolon) rather than ',' (comma)?
(Just wandering)
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=22657&edit=1
