arr_index errorneusly included the trailing ']' character, so that

variable names like Data_name[Image]] were passed to the register functions.

diff --git a/main/rfc1867.c b/main/rfc1867.c
index 195b567f80f002b9b335dec8be77a0e31787aee3..10a5843946c483f20c397c13fa3b2329f80cf226 100644 (file)
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -207,7 +207,7 @@ static void php_mime_split(char *buf, int cnt, char *boundary, zval *array_ptr S
                                        if(is_arr_upload) {
                                                arr_len = strlen(start_arr);
                                                if(arr_index) efree(arr_index);
-                                               arr_index = estrndup(start_arr+1,arr_len-1);    
+                                               arr_index = estrndup(start_arr+1,arr_len-2);    
                                        }
                                } else {
                                        php_error(E_WARNING, "File upload error - no name component in content disposition");