clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-23 10:57:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #79221 - Null Pointer Dereference in PHP Session Upload Progress

Browse Source
This commit is contained in:
Stanislav Malyshev 2020-02-15 20:52:19 -08:00
parent 0966941130
commit 409965fe1c
2 changed files with 51 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ext/session/session.c
View File

@ -3308,11 +3308,13 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
if (PS(rfc1867_cleanup)) {
php_session_rfc1867_cleanup(progress);
} else {
if (!Z_ISUNDEF(progress->data)) {
SEPARATE_ARRAY(&progress->data);
add_assoc_bool_ex(&progress->data, "done", sizeof("done") - 1, 1);
Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;
php_session_rfc1867_update(progress, 1);
}
}
php_rshutdown_session_globals();
}

45
ext/session/tests/bug79221.phpt Normal file
View File

@ -0,0 +1,45 @@
--TEST--
Null Pointer Dereference in PHP Session Upload Progress
--INI--
error_reporting=0
file_uploads=1
upload_max_filesize=1024
session.save_path=
session.name=PHPSESSID
session.serialize_handler=php
session.use_strict_mode=0
session.use_cookies=1
session.use_only_cookies=0
session.upload_progress.enabled=1
session.upload_progress.cleanup=0
session.upload_progress.prefix=upload_progress_
session.upload_progress.name=PHP_SESSION_UPLOAD_PROGRESS
session.upload_progress.freq=1%
session.upload_progress.min_freq=0.000000001
--COOKIE--
PHPSESSID=session-upload
--POST_RAW--
Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
-----------------------------20896060251896012921717172737
Content-Disposition: form-data; name="PHPSESSID"
session-upload
-----------------------------20896060251896012921717172737
Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS"
ryat
-----------------------------20896060251896012921717172737
Content-Disposition: form-data; file="file"; ryat="filename"
1
-----------------------------20896060251896012921717172737--
--FILE--
<?php
session_start();
var_dump($_SESSION);
session_destroy();
--EXPECTF--
array(0) {
}