@@ -100,10 +100,10 @@ void destroy_uploaded_files_hash(TSRMLS_D)
100
100
/*
101
101
* Split raw mime stream up into appropriate components
102
102
*/
103
- static void php_mime_split (char * buf , int cnt , char * boundary , zval * array_ptr TSRMLS_DC )
103
+ static void php_mime_split (char * buf , int cnt , char * boundary , int len , zval * array_ptr TSRMLS_DC )
104
104
{
105
105
char * ptr , * loc , * loc2 , * loc3 , * s , * name , * filename , * u , * temp_filename ;
106
- int len , state = 0 , Done = 0 , rem , urem ;
106
+ int state = 0 , Done = 0 , rem , urem ;
107
107
int eolsize ;
108
108
long bytes , max_file_size = 0 ;
109
109
char * namebuf = NULL , * filenamebuf = NULL , * lbuf = NULL ,
@@ -126,7 +126,7 @@ static void php_mime_split(char *buf, int cnt, char *boundary, zval *array_ptr T
126
126
127
127
ptr = buf ;
128
128
rem = cnt ;
129
- len = strlen ( boundary );
129
+
130
130
while ((ptr - buf < cnt ) && !Done ) {
131
131
switch (state ) {
132
132
case 0 : /* Looking for mime boundary */
@@ -443,6 +443,22 @@ static void php_mime_split(char *buf, int cnt, char *boundary, zval *array_ptr T
443
443
}
444
444
445
445
446
+ /*
447
+ * Reads post data chunk
448
+ *
449
+ */
450
+ static int read_post_data_chunk (char * buf TSRMLS_DC )
451
+ {
452
+ int read_bytes ;
453
+
454
+ read_bytes = sapi_module .read_post (buf , SAPI_POST_BLOCK_SIZE TSRMLS_CC );
455
+
456
+ SG (read_post_bytes ) += read_bytes ;
457
+
458
+ return read_bytes ;
459
+ }
460
+
461
+
446
462
SAPI_API SAPI_POST_HANDLER_FUNC (rfc1867_post_handler )
447
463
{
448
464
char * boundary ;
@@ -454,6 +470,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
454
470
return ;
455
471
}
456
472
473
+ if (SG (request_info ).content_length > SG (post_max_size )) {
474
+ sapi_module .sapi_error (E_COMPILE_ERROR , "POST Content-Length of %d bytes exceeds the limit of %d bytes" , SG (request_info ).content_length , SG (post_max_size ));
475
+ return ;
476
+ }
477
+
457
478
boundary = strstr (content_type_dup , "boundary" );
458
479
if (!boundary || !(boundary = strchr (boundary , '=' ))) {
459
480
sapi_module .sapi_error (E_COMPILE_ERROR , "Missing boundary in multipart/form-data POST data" );
@@ -468,12 +489,40 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
468
489
boundary [boundary_len ] = '\0' ;
469
490
}
470
491
492
+ /* <FIXME> Temporary. Should be done same time as parsing. Maybe that Apache stuff.. */
493
+ {
494
+ int allocated_bytes = SAPI_POST_BLOCK_SIZE + 1 , read_bytes ;
495
+
496
+ SG (request_info ).post_data = emalloc (allocated_bytes );
497
+
498
+ for (;;) {
499
+ read_bytes = read_post_data_chunk (SG (request_info ).post_data + SG (read_post_bytes ) TSRMLS_CC );
500
+
501
+ if (read_bytes <= 0 || read_bytes < SAPI_POST_BLOCK_SIZE ) {
502
+ break ;
503
+ }
504
+
505
+ if (SG (read_post_bytes ) > SG (post_max_size )) {
506
+ php_error (E_WARNING , "Actual POST length does not match Content-Length, and exceeds %d bytes" , SG (post_max_size ));
507
+ return ;
508
+ }
509
+
510
+ if (SG (read_post_bytes ) + SAPI_POST_BLOCK_SIZE >= allocated_bytes ) {
511
+ allocated_bytes = SG (read_post_bytes )+ SAPI_POST_BLOCK_SIZE + 1 ;
512
+ SG (request_info ).post_data = erealloc (SG (request_info ).post_data , allocated_bytes );
513
+ }
514
+ }
515
+
516
+ SG (request_info ).post_data [SG (read_post_bytes )] = 0 ; /* terminating NULL */
517
+ SG (request_info ).post_data_length = SG (read_post_bytes );
518
+ }
519
+ /* </FIXME> */
520
+
471
521
if (SG (request_info ).post_data ) {
472
- php_mime_split (SG (request_info ).post_data , SG (request_info ).post_data_length , boundary , array_ptr TSRMLS_CC );
522
+ php_mime_split (SG (request_info ).post_data , SG (request_info ).post_data_length , boundary , boundary_len , array_ptr TSRMLS_CC );
473
523
}
474
524
}
475
525
476
-
477
526
/*
478
527
* Local variables:
479
528
* tab-width: 4
0 commit comments