Fix #8486 (name= without quotes in MIME Content-Disposition header)

Ported fix by kk/sas from PHP 3

diff --git a/main/rfc1867.c b/main/rfc1867.c
index 40567f3507545919deb5f749d1961986b0c48062..195b567f80f002b9b335dec8be77a0e31787aee3 100644 (file)
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -167,11 +167,20 @@ static void php_mime_split(char *buf, int cnt, char *boundary, zval *array_ptr S
                                        SAFE_RETURN;
                                }
                                loc = memchr(ptr, '\n', rem);
-                               name = strstr(ptr, " name=\"");
+                               name = strstr(ptr, " name=");
                                if (name && name < loc) {
-                                       name += 7;
+                                       name += 6;
                                        s = memchr(name, '\"', loc - name);
-                                       if (!s) {
+                                       if ( name == s ) { 
+                                               name++;
+                                               s = memchr(name, '\"', loc - name);
+                                               if(!s) {
+                                                       php_error(E_WARNING, "File Upload Mime headers garbled name: [%c%c%c%c%c]", *name, *(name + 1), *(name + 2), *(name + 3), *(name + 4));
+                                                       SAFE_RETURN;
+                                               }
+                                       } else if(!s) {
+                                               s = loc;
+                                       } else {
                                                php_error(E_WARNING, "File Upload Mime headers garbled name: [%c%c%c%c%c]", *name, *(name + 1), *(name + 2), *(name + 3), *(name + 4));
                                                SAFE_RETURN;
                                        }