Re: [Security-Discuss] Strange problem after latest php update (MDKSA-2005:152)

On Mon, 29 Aug 2005, Gianluca Faieta wrote:

> Hi all,
> 
> I found a very strange problem regarding the latest PHP update
> on Mandrake 10.0: the following code gives "Zero Sized Reply" error
> if run under Apache (http://my.host.name/preg1.php) while it runs
> correctly from the command line (# php preg1.php).
> 
> ---- begin code snippet -------------------------
> <?php
>   define( 'ANY_NAME', 'any value' );
>   $a = preg_match('/^[A-Za-z0-9]*$/', $any_variable);
>   echo "DONE!\n";
> ?>
> ---- end   code snippet -------------------------
> 
> The "fantastic" thing is that commenting the define solves the
> problem under Apache.
> 
> It gave the same error on two different hosts, both of which are
> always updated with the latest Mandriva patches. Neither the previous
> update (4.5.100mdk) nor the stock packages have this problem.
> 
> Php extensions on the affected hosts are the common ones (GD, MySQL,
> IMAP, XML).
> 
> Anyone experiencing the same problem?
> 
> Maybe, updated packages should be rebuilt using the previous method
> (private pcre) instead of the system pcre libs.
> 

Well, the packages were rebuilt against the system pcre for a reason. 
There's a vulnerability in pcre. If I was to use the private pcre, I would 
be patching it in the same fashion, with possibly the same result, plus 
I'd be locked into forever patching both packages.

I'm currently investigating another issue with the updates, and will look 
at this too.

Are you using:

apache1 or apche2?
php-cgi or mod_php?

Regards,
-- 
Stew Benedict
Mandriva
Mandrakesoft becomes Mandriva

____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________