summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorXinchen Hui <laruence@php.net>2011-11-03 07:26:09 (GMT)
committerXinchen Hui <laruence@php.net>2011-11-03 07:26:09 (GMT)
commitd7d0d0724c5de6397a4c9999568bc1fd7105ef5f (patch)
treef24a2e34a47d3d6828d8ef6d31605a5feba4fe95
parent64978cb2d9b7fd8721280127630189c126f36784 (diff)
downloadphp-d7d0d0724c5de6397a4c9999568bc1fd7105ef5f.tar.gz
Fixed bug #60206 (possible integer overflow in content_length)
-rw-r--r--sapi/apache/mod_php5.c2
-rw-r--r--sapi/apache2filter/sapi_apache2.c2
-rw-r--r--sapi/apache2handler/sapi_apache2.c2
-rw-r--r--sapi/apache_hooks/mod_php5.c2
-rw-r--r--sapi/cgi/cgi_main.c2
-rw-r--r--sapi/fpm/fpm/fpm_main.c2
6 files changed, 6 insertions, 6 deletions
diff --git a/sapi/apache/mod_php5.c b/sapi/apache/mod_php5.c
index 16f7756..74148be 100644
--- a/sapi/apache/mod_php5.c
+++ b/sapi/apache/mod_php5.c
@@ -529,7 +529,7 @@ static void init_request_info(TSRMLS_D)
SG(request_info).request_uri = r->uri;
SG(request_info).request_method = (char *)r->method;
SG(request_info).content_type = (char *) table_get(r->subprocess_env, "CONTENT_TYPE");
- SG(request_info).content_length = (content_length ? atoi(content_length) : 0);
+ SG(request_info).content_length = (content_length ? atol(content_length) : 0);
SG(sapi_headers).http_response_code = r->status;
SG(request_info).proto_num = r->proto_num;
diff --git a/sapi/apache2filter/sapi_apache2.c b/sapi/apache2filter/sapi_apache2.c
index b8699a9..c3d6d5f 100644
--- a/sapi/apache2filter/sapi_apache2.c
+++ b/sapi/apache2filter/sapi_apache2.c
@@ -419,7 +419,7 @@ static void php_apache_request_ctor(ap_filter_t *f, php_struct *ctx TSRMLS_DC)
efree(content_type);
content_length = (char *) apr_table_get(f->r->headers_in, "Content-Length");
- SG(request_info).content_length = (content_length ? atoi(content_length) : 0);
+ SG(request_info).content_length = (content_length ? atol(content_length) : 0);
apr_table_unset(f->r->headers_out, "Content-Length");
apr_table_unset(f->r->headers_out, "Last-Modified");
diff --git a/sapi/apache2handler/sapi_apache2.c b/sapi/apache2handler/sapi_apache2.c
index a7f250d..bb772b2 100644
--- a/sapi/apache2handler/sapi_apache2.c
+++ b/sapi/apache2handler/sapi_apache2.c
@@ -483,7 +483,7 @@ static int php_apache_request_ctor(request_rec *r, php_struct *ctx TSRMLS_DC)
r->no_local_copy = 1;
content_length = (char *) apr_table_get(r->headers_in, "Content-Length");
- SG(request_info).content_length = (content_length ? atoi(content_length) : 0);
+ SG(request_info).content_length = (content_length ? atol(content_length) : 0);
apr_table_unset(r->headers_out, "Content-Length");
apr_table_unset(r->headers_out, "Last-Modified");
diff --git a/sapi/apache_hooks/mod_php5.c b/sapi/apache_hooks/mod_php5.c
index b976edf..0a814df 100644
--- a/sapi/apache_hooks/mod_php5.c
+++ b/sapi/apache_hooks/mod_php5.c
@@ -582,7 +582,7 @@ static void init_request_info(TSRMLS_D)
SG(request_info).request_method = (char *)r->method;
SG(request_info).proto_num = r->proto_num;
SG(request_info).content_type = (char *) table_get(r->subprocess_env, "CONTENT_TYPE");
- SG(request_info).content_length = (content_length ? atoi(content_length) : 0);
+ SG(request_info).content_length = (content_length ? atol(content_length) : 0);
SG(sapi_headers).http_response_code = r->status;
if (r->headers_in) {
diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
index b6acb81..06a6fda 100644
--- a/sapi/cgi/cgi_main.c
+++ b/sapi/cgi/cgi_main.c
@@ -1412,7 +1412,7 @@ static void init_request_info(fcgi_request *request TSRMLS_DC)
/* FIXME - Work out proto_num here */
SG(request_info).query_string = CGI_GETENV("QUERY_STRING");
SG(request_info).content_type = (content_type ? content_type : "" );
- SG(request_info).content_length = (content_length ? atoi(content_length) : 0);
+ SG(request_info).content_length = (content_length ? atol(content_length) : 0);
/* The CGI RFC allows servers to pass on unvalidated Authorization data */
auth = CGI_GETENV("HTTP_AUTHORIZATION");
diff --git a/sapi/fpm/fpm/fpm_main.c b/sapi/fpm/fpm/fpm_main.c
index a9298e7..6ad53df 100644
--- a/sapi/fpm/fpm/fpm_main.c
+++ b/sapi/fpm/fpm/fpm_main.c
@@ -1325,7 +1325,7 @@ static void init_request_info(TSRMLS_D)
/* FIXME - Work out proto_num here */
SG(request_info).query_string = sapi_cgibin_getenv("QUERY_STRING", sizeof("QUERY_STRING") - 1 TSRMLS_CC);
SG(request_info).content_type = (content_type ? content_type : "" );
- SG(request_info).content_length = (content_length ? atoi(content_length) : 0);
+ SG(request_info).content_length = (content_length ? atol(content_length) : 0);
/* The CGI RFC allows servers to pass on unvalidated Authorization data */
auth = sapi_cgibin_getenv("HTTP_AUTHORIZATION", sizeof("HTTP_AUTHORIZATION") - 1 TSRMLS_CC);