Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:15498
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Date: Sat, 19 Mar 2005 01:32:09 +0200 (EET)
Reply-To: Jani Taskinen <sniper@iki.fi>
To: Jozef Hatala <phpint-bkrrym@skrt.org>
Cc: internals@lists.php.net
In-Reply-To: <20050316223422.GB11662@u-hatala.rd.francetelecom.fr>
Message-ID: <Pine.LNX.4.61.0503190130590.12076@arfg.argcubovn.sv>
References: <20050316223422.GB11662@u-hatala.rd.francetelecom.fr>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Subject: Re: [PHP-DEV] [PATCH] Fix for php://input returning duplicate data
	in some cases
From: sniper@iki.fi (Jani Taskinen)


     Are there any bug reports about this at bugs.php.net ?
     If not, enter one and put the patch online somewhere were
     we can download it as text file. (and the url to that into
     the bug report)

     Does this problem exist with PHP_4_3 branch?

     --Jani


On Wed, 16 Mar 2005, Jozef Hatala wrote:

> In some cases, the php://input stream returns incorrect data.
> This was discovered as a data corruption when directly parsing
> a POSTed XML with a long text-node.
>
> The problem is between main/streams/streams.c and
> ext/standard/php_fopen_wrapper.c.
>
> The XML parser requests data from the stream in 4000 byte
> chunks.
>
> _php_stream_read requests data from the handler for php://input
> in 8192 byte chunks.  It uses two counters stream->readpos
> and stream->writepos to handle the buffering.  Just before
> returning the next 4000 byte chunk, _php_stream_read advances
> the stream->position.
>
> The handler for php://input in php_stream_input_read
> uses stream->position to address the contents of
> SG(request_info).raw_post_data and serves a 8192 byte chunk
> starting at that position.
>
> The problem shows itself on the third call of _php_stream_read.
> In the first iteration of the while(size>0) loop, it uses the
> 192 bytes left over in the buffer.  In the second iteration it
> needs to refill to buffer, so it calls php_stream_input_read.
> But stream->position has not been advanced by 192 yet, so
> php_stream_input_read ends up returning a buffer starting with
> the same 192 bytes.
>
> The patch consists in simply updating stream->position
> immediately, instead of accumulating didread and only updating
> stream->position at the end.  This way php_stream_input_read
> always sees an accurate value of the stream->position.
>
> Here it is.  It is made against php-5.0.3, but it also applies
> to php5-200503161930.
>
> ==== begin ====
> diff -ru php-5.0.3.orig/main/streams/streams.c php-5.0.3/main/streams/streams.c
> --- php-5.0.3.orig/main/streams/streams.c	2004-11-15 15:44:14.000000000 -0800
> +++ php-5.0.3/main/streams/streams.c	2005-03-16 13:08:02.000000000 -0800
> @@ -560,6 +560,7 @@
> 			size -= toread;
> 			buf += toread;
> 			didread += toread;
> +			stream->position += toread;
> 		}
>
> 		/* ignore eof here; the underlying state might have changed */
> @@ -584,6 +585,7 @@
> 		}
> 		if (toread > 0) {
> 			didread += toread;
> +			stream->position += toread;
> 			buf += toread;
> 			size -= toread;
> 		} else {
> @@ -596,10 +598,6 @@
> 			break;
> 	}
>
> -	if (didread > 0) {
> -		stream->position += didread;
> -	}
> -
> 	return didread;
> }
>
> ==== end ====
>
>

-- 
https://www.paypal.com/xclick/business=sniper@php.net&no_note=1&tax=0&currency_code=EUR