Bug #74318 [Opn->Csd]: Partially uploaded files are not deleted

Edit report at https://bugs.php.net/bug.php?id=74318&edit=1

 ID:                 74318
 Updated by:         [email protected]
 Reported by:        vobruba dot martin at gmail dot com
 Summary:            Partially uploaded files are not deleted
-Status:             Open
+Status:             Closed
 Type:               Bug
 Package:            Apache2 related
 PHP Version:        7.1.3
-Assigned To:        
+Assigned To:        ab
 Block user comment: N
 Private report:     N

 New Comment:

Fixed by reverting 80c8d84af303d2fddc9ba9f181c7117b9040811d, bug #61471 reopened once again.

Thanks.


Previous Comments:
------------------------------------------------------------------------
[2017-03-28 06:51:49] vobruba dot martin at gmail dot com

BTW I believe this is a security issue because anyone can easily cause a denial of service using this bug.

------------------------------------------------------------------------
[2017-03-27 14:53:21] vobruba dot martin at gmail dot com

Description:
------------
If you make an incomplete upload request (Content-Length header value is larger than POSTed body) a temporary upload_tmp_dir/php* file won't be deleted after the request is processed by server which is bad because upload_tmp_dir is growing in size.

I think that this is related to this patch https://github.com/php/php-src/pull/2323 because I cannot replicate this problem in 7.1.2.

Test script:
---------------
<?php

$rn = "\r\n";
$boundary = '------------------BOUNDARY';
$fileSize = 5 * 1024 * 1024;	// upload size must be larger than input buffer size
$offset = 1000;	// should cause timeout if distinctly larger than 0
$connectHost = 'CHANGE.THIS.HOST';
$connectPort = 443;
$connectProto = 'ssl';
$requestUri = '/upload.php';

$content  = '--'.$boundary.$rn;
$content .= 'Content-Disposition: form-data; name="file"; filename="test.txt"'.$rn;
$content .= 'Content-Type: application/octet-stream'.$rn.$rn;
$content .= str_repeat('a', $fileSize).$rn;
$content .= '--'.$boundary.'--';

$headers  = 'POST '.$requestUri.' HTTP/1.1'.$rn;
$headers .= 'Host: '.$connectHost.$rn;
$headers .= 'Connection: close'.$rn;
$headers .= 'Content-Length: '.(strlen($content) + $offset).$rn;
$headers .= 'Content-Type: multipart/form-data; boundary='.$boundary.$rn.$rn;


$socket = fsockopen($connectProto.'://'.$connectHost, $connectPort);
fwrite($socket, $headers.$rn.$content);
while(!feof($socket)) {
	echo fread($socket, 1024);
}
fclose($socket);


Expected result:
----------------
Associated upload_tmp_dir/php* file is deleted after the request is processed.

Actual result:
--------------
Associated upload_tmp_dir/php* file is not deleted.


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=74318&edit=1