diff options
| author | Stefan Esser <sesser@php.net> | 2002-02-21 18:46:45 +0000 |
|---|---|---|
| committer | Stefan Esser <sesser@php.net> | 2002-02-21 18:46:45 +0000 |
| commit | d1336b2fce9b681ac2a533e58cbf11a1f42ff990 (patch) | |
| tree | 5adecb7a7a279b268389d760f5ce1ef57c483ecb | |
| parent | cfe1d846287cc2759777d2642c38c762f1a0f800 (diff) | |
| download | php-git-d1336b2fce9b681ac2a533e58cbf11a1f42ff990.tar.gz | |
fixing boundary check before someone other does it...
| -rw-r--r-- | main/rfc1867.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/main/rfc1867.c b/main/rfc1867.c index 971fead6b3..f6cf7940e9 100644 --- a/main/rfc1867.c +++ b/main/rfc1867.c @@ -195,7 +195,13 @@ static void php_mime_split(char *buf, int cnt, char *boundary, zval *array_ptr T SAFE_RETURN; } } + rem -= loc - ptr; + if (rem <= 0) { + php_error(E_WARNING, "File Upload Mime headers garbled ptr: [%c%c%c%c%c]", *ptr, *(ptr + 1), *(ptr + 2), *(ptr + 3), *(ptr + 4)); + SAFE_RETURN; + } name = strstr(ptr, " name="); + ptr = loc; if (name && name < loc) { name += 6; if ( *name == '\"' ) { |