@- Fixed RFC1867 file upload under Windows (Zeev)

Fixed a memory leak

diff --git a/main/php_variables.c b/main/php_variables.c
index 8f02d0c54121a0dcc79abe9b7c703687fc90856d..842b5d47eb9b35efe863276b6a929559b9db9ef5 100644 (file)
--- a/main/php_variables.c
+++ b/main/php_variables.c
@@ -192,7 +192,18 @@ void php_treat_data(int arg, char *str ELS_DC PLS_DC SLS_DC)
                                INIT_PZVAL(array_ptr);
                                switch (arg) {
                                        case PARSE_POST:
-                                               zend_hash_add_ptr(&EG(symbol_table), "HTTP_POST_VARS", sizeof("HTTP_POST_VARS"), array_ptr, sizeof(pval *),NULL);
+                                               if (zend_hash_add_ptr(&EG(symbol_table), "HTTP_POST_VARS", sizeof("HTTP_POST_VARS"), array_ptr, sizeof(pval *),NULL)==FAILURE) {
+                                                       zval **p;
+
+                                                       /* This could happen if we're in RFC 1867 file upload */
+                                                       /* The parsing portion of the POST reader should actually move
+                                                        * to this function  - Zeev
+                                                        */
+                                                       zval_dtor(array_ptr);
+                                                       FREE_ZVAL(array_ptr);
+                                                       zend_hash_find(&EG(symbol_table), "HTTP_POST_VARS", sizeof("HTTP_POST_VARS"), (void **) &p);
+                                                       array_ptr = *p;
+                                               }
                                                break;
                                        case PARSE_GET:
                                                zend_hash_add_ptr(&EG(symbol_table), "HTTP_GET_VARS", sizeof("HTTP_GET_VARS"), array_ptr, sizeof(pval *),NULL);

diff --git a/main/rfc1867.c b/main/rfc1867.c
index e9c430c1e591d8305962848ebf9c0b6b16725cdd..ef01e1e3f86d3ce6319d2cbc82a20158e1490f24 100644 (file)
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -67,8 +67,9 @@ static void php_mime_split(char *buf, int cnt, char *boundary)
                                                state = 1;
 
                                                eolsize = 2;
-                                               if(*(loc+len)==0x0a)
+                                               if(*(loc+len)==0x0a) {
                                                        eolsize = 1;
+                                               }
 
                                                rem -= (loc - ptr) + len + eolsize;
                                                ptr = loc + len + eolsize;
@@ -204,7 +205,7 @@ static void php_mime_split(char *buf, int cnt, char *boundary)
                                        php_error(E_WARNING, "File Upload Error - No Mime boundary found after start of file header");
                                        SAFE_RETURN;
                                }
-                               fn = tempnam(PG(upload_tmp_dir), "php");
+                                       fn = tempnam(PG(upload_tmp_dir), "php");
                                if ((loc - ptr - 4) > PG(upload_max_filesize)) {
                                        php_error(E_WARNING, "Max file size of %ld bytes exceeded - file [%s] not saved", PG(upload_max_filesize),namebuf);
                                        bytes=0;        
@@ -217,7 +218,7 @@ static void php_mime_split(char *buf, int cnt, char *boundary)
                                        bytes = 0;
                                        SET_VAR_STRING(namebuf, estrdup("none"));
                                } else {
-                                       fp = fopen(fn, "w");
+                                       fp = fopen(fn, "wb");
                                        if (!fp) {
                                                php_error(E_WARNING, "File Upload Error - Unable to open temporary file [%s]", fn);
                                                SAFE_RETURN;