Bug #32491 (File upload error - unable to create a temporary file) - Changing file upload from stdio to posix

NEWS

@@ -96,6 +96,8 @@ PHP                                                                        NEWS
 - Fixed bug with raw_post_data not getting set. (Brian)
 - Fixed bug in mysql::client_version(). (Georg)
 - Fixed ZTS destruction. (Marcus)
+- Fixed bug #32491 (File upload error - unable to create a temporary file).
+  (Uwe Schindler)
 - Fixed bug #32109 ($_POST is not populated in multithreaded environment).
   (Moriyoshi)
 - Fixed bug #31478 (segfault with empty() / isset()). (Moriyoshi)

main/rfc1867.c

@@ -784,7 +784,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
 	zend_bool magic_quotes_gpc;
 	multipart_buffer *mbuff;
 	zval *array_ptr = (zval *) arg;
-	FILE *fp;
+	int fd=-1;
 	zend_llist header;
 
 	if (SG(request_info).content_length > SG(post_max_size)) {
@@ -969,8 +969,8 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
 
 			if (!skip_upload) {
 				/* Handle file */
-				fp = php_open_temporary_file(PG(upload_tmp_dir), "php", &temp_filename TSRMLS_CC);
-				if (!fp) {
+				fd = php_open_temporary_fd(PG(upload_tmp_dir), "php", &temp_filename TSRMLS_CC);
+				if (fd==-1) {
 					sapi_module.sapi_error(E_WARNING, "File upload error - unable to create a temporary file");
 					cancel_upload = UPLOAD_ERROR_E;
 				}
@@ -1001,7 +1001,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
 #endif
 					cancel_upload = UPLOAD_ERROR_B;
 				} else if (blen > 0) {
-					wlen = fwrite(buff, 1, blen, fp);
+					wlen = write(fd, buff, blen);
 			
 					if (wlen < blen) {
 #if DEBUG_FILE_UPLOAD
@@ -1013,8 +1013,8 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
 					}
 				} 
 			}
-			if (fp) { /* may not be initialized if file could not be created */
-				fclose(fp);
+			if (fd!=-1) { /* may not be initialized if file could not be created */
+				close(fd);
 			}
 
 #if DEBUG_FILE_UPLOAD