Project

General

Profile

Actions

Bug #2152

closed

File upload doesn't work if the file is bigger than [512k?]

Added by arnotixe over 15 years ago. Updated over 15 years ago.

Status:
Invalid
Priority:
Normal
Category:
-
Target version:
-
ASK QUESTIONS IN Forums:

Description

My last issue was deleted by accident, so here goes:

No errors in /var/log/lighttpd/errors.log

A few files called lighttp* and later php* appear in /tmp

ahl:/tmp# while true; do ls -l |grep -v sess && echo .; done
-rw------ 1 lighttpd lighttpd 298177 Jan 11 17:52 lighttpd-upload-Ib7A6u
.
rw------ 1 lighttpd lighttpd 816561 Jan 11 17:52 lighttpd-upload-Ib7A6u
.
rw------ 1 lighttpd lighttpd 173760 Jan 11 17:52 lighttpd-upload-GSfToa
rw------ 1 lighttpd lighttpd 1049689 Jan 11 17:52 lighttpd-upload-Ib7A6u
.
rw------ 1 lighttpd lighttpd 386428 Jan 11 17:52 lighttpd-upload-GSfToa
rw------ 1 lighttpd lighttpd 1049689 Jan 11 17:52 lighttpd-upload-Ib7A6u
rw------ 1 lighttpd lighttpd 716660 Jan 11 17:52 phpqwZAOS

My upload.php, pretty basic, should just save the file. It DOES work when the uploaded file is small, for example 341kB.
---------------

<?php 
     header('Content-type: text/html; charset=utf-8');

     $uploadedfile = $_FILES['userfile']['tmp_name'];
    echo "The file uploaded was $uploadedfile.";

     $storefile = $_POST['fnr'] . ".png";

     $command = "cp -v $uploadedfile $storefile"; // save the uploaded file.
     passthru($command); // save 

?>

It seems lighttpd builds several files of around 1MB and then puts them together to one file, phpqwZAOS is seen above.

But when it's too big a file, that file isn't available and doesn't show up in the $_FILES[] array of PHP. Problem with lighttpd passing the file to php?

lighttpd version: lighttpd-1.4.23-r2

OS: alpine linux 2.6.30.8-grsec

Attached strace of a post of a big file.


Files

strace-too-big-upload.txt (342 KB) strace-too-big-upload.txt arnotixe, 2010-01-11 20:10
Actions #1

Updated by arnotixe over 15 years ago

got a fix from alpine linux, seems something's up there. Now I can upload up to 965259b, but 1013956b fails.

Actions #2

Updated by icy over 15 years ago

  • Status changed from New to Need Feedback

Just a quick note: your php code is vulnerable to file overwriting and command injection since you do no validation at all and you use the wrong functions to move the file.

lighttpd-1.4.23-r2 is old, current stable one is 1.4.25

Actions #3

Updated by arnotixe over 15 years ago

  • % Done changed from 0 to 100

oh no it seems that the MAX_FILE_SIZE tag (I don't remember why it's there on the form anyway) is parsed by PHP even if I don't tell it to o_O

Let's see what happens when I remove that tag.. sorry to waste your time Now I got a 9.5MB file through... I think you can close this bug -
"a tag called MAX_FILE_SIZE in the 'upload file' form was [silently] parsed by php"

I didn't suspect that tag since I hadn't written php any code checking it. Apparently that's done automatically by php and also "taken care of" automatically, dropping the file (googled http://bytes.com/topic/php/answers/647849-max_file_size-html-forms)

Sorry to cause a stir

Actions

Also available in: Atom