Package home | Report new bug | New search | Development Roadmap Status: Open | Feedback | All | Closed Since Version 0.4.1

Bug #2531 Server shutdown on bad Request
Submitted: 2004-10-14 11:53 UTC Modified: 2005-01-01 06:39 UTC
From: maka3d at yahoo dot com dot br Assigned: schst
Status: Closed Package: HTTP_Server
PHP Version: 4.3.9 OS: any
Roadmaps: (Not assigned)    
Subscription  


 [2004-10-14 11:53 UTC] maka3d at yahoo dot com dot br
Description: ------------ Fatal error: Call to a member function on a non-object in PEAR\HTTP\Server.php on line 219 The problem is that $request is false when a bad request is received. The line 203 to 205 could be changed from: $request = &HTTP_Server_Request::parse($data); $this->_serveRequest($clientId, $request); to: $request = &HTTP_Server_Request::parse($data); if($request === false) { $this->onBadRequest($clientId, $data); } $this->_serveRequest($clientId, $request); Reproduce code: --------------- Just star the server and send a bad Request like: HTTPFOO/1.0 Expected result: ---------------- Server should handle the bad request Actual result: -------------- A fatal error and server shutdown

Comments

 [2004-11-16 06:24 UTC] cox at idecnet dot com
I've verified this error and involves a security problem of the class.
 [2005-01-01 06:39 UTC] schst
This bug has been fixed in CVS. In case this was a documentation problem, the fix will show up at the end of next Sunday (CET) on pear.php.net. In case this was a pear.php.net website problem, the change will show up on the website in short time. Thank you for the report, and for helping us make PEAR better.