From: Stefan Esser <sesser@php.net>
Date: Sun, 12 Sep 2004 10:46:49 +0000 (+0000)
Subject: MFH
X-Git-Tag: php-4.3.9RC3~5
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=3e7f149be64e64e93afe01696d2cbb48770ba70c;p=php

MFH
---

diff --git a/main/rfc1867.c b/main/rfc1867.c
index 1c2adef9a6..b6604d04d7 100644
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -932,6 +932,25 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
 				}
 				SAFE_RETURN;
 			}
+			
+			/* New Rule: never repair potential malicious user input */
+			if (!skip_upload) {
+				char *tmp = param;
+				long c = 0;
+				
+				while (*tmp) {
+					if (*tmp == '[') {
+						c++;
+					} else if (*tmp == ']') {
+						c--;
+					}
+					if (c < 0) {
+						skip_upload = 1;
+						break;
+					}
+					tmp++;				
+				}
+			}
 
 			if (!skip_upload) {
 				/* Handle file */
@@ -1000,10 +1019,6 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
 			 * start_arr is set to point to 1st [
 			 */
 			is_arr_upload =	(start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');
-			/* handle unterminated [ */
-			if (!is_arr_upload && start_arr) {
-				*start_arr = '_';
-			}
 
 			if (is_arr_upload) {
 				array_len = strlen(start_arr);