Fix a crash bug in CURLOPT_POSTFIELDS by using curl_formadd instead of

curl_formparse

Fix a crash bug when CURLOPT_INFILE is not properly specified.

diff --git a/ext/curl/curl.c b/ext/curl/curl.c
index 43dfebd5b8dd1f2631696d90e1b9aed965997b64..26bdd73a3b02a6419282ee1f67d6518946c07da2 100644 (file)
--- a/ext/curl/curl.c
+++ b/ext/curl/curl.c
@@ -706,8 +706,11 @@ PHP_FUNCTION(curl_setopt)
        case CURLOPT_INFILE: 
        case CURLOPT_WRITEHEADER:
        case CURLOPT_STDERR: {
-               FILE *fp;
+               FILE *fp = NULL;
                ZEND_FETCH_RESOURCE(fp, FILE *, zvalue, -1, "File-Handle", php_file_le_fopen());
+               if (!fp) {
+                       RETURN_FALSE;
+               }
 
                error = CURLE_OK;
                switch (option) {
@@ -789,11 +792,8 @@ PHP_FUNCTION(curl_setopt)
 
                                zend_hash_get_current_key_ex(postfields, &string_key, &string_key_len, &num_key, 0, NULL);
 
-                               postval = emalloc((string_key_len - 1) + Z_STRLEN_PP(current) + 1);
-                               snprintf(postval, (sizeof("%s=%s") - 1) + (string_key_len - 1) + Z_STRLEN_PP(current), 
-                                        "%s=%s", string_key, Z_STRVAL_PP(current));
-
-                               error = curl_formparse(postval, &first, &last);
+                               error = curl_formadd(&first, &last, CURLFORM_COPYNAME, string_key, 
+                                                                        CURLFORM_PTRCONTENTS, Z_STRVAL_PP(current), CURLFORM_END);
                        }
 
                        if (error != CURLE_OK) {