php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 08:12:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.4' into PHP-8.0

Browse Source 
* PHP-7.4:
  Fix #80849: HTTP Status header truncation
This commit is contained in:
Christoph M. Becker
2021-07-15 19:13:13 +02:00
parent fc6656e0ac a054ef2aad
commit bb4dbbc150
5 changed files with 63 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@@ -5,6 +5,9 @@ PHP NEWS
- Core:
. Fixed bug #72595 (php_output_handler_append illegal write access). (cmb)
- CGI:
. Fixed bug #80849 (HTTP Status header truncation). (cmb)
- Standard:
. Fixed bug #72146 (Integer overflow on substr_replace). (cmb)

9
sapi/cgi/cgi_main.c
View File

@@ -383,7 +383,7 @@ static int sapi_cgi_send_headers(sapi_headers_struct *sapi_headers)
if (CGIG(rfc2616_headers) && SG(sapi_headers).http_status_line) {
char *s;
len = slprintf(buf, SAPI_CGI_MAX_HEADER_LENGTH, "%s\r\n", SG(sapi_headers).http_status_line);
len = slprintf(buf, SAPI_CGI_MAX_HEADER_LENGTH, "%s", SG(sapi_headers).http_status_line);
if ((s = strchr(SG(sapi_headers).http_status_line, ' '))) {
response_status = atoi((s + 1));
}
@@ -400,7 +400,7 @@ static int sapi_cgi_send_headers(sapi_headers_struct *sapi_headers)
(s - SG(sapi_headers).http_status_line) >= 5 &&
strncasecmp(SG(sapi_headers).http_status_line, "HTTP/", 5) == 0
) {
len = slprintf(buf, sizeof(buf), "Status:%s\r\n", s);
len = slprintf(buf, sizeof(buf), "Status:%s", s);
response_status = atoi((s + 1));
} else {
h = (sapi_header_struct*)zend_llist_get_first_ex(&sapi_headers->headers, &pos);
@@ -423,9 +423,9 @@ static int sapi_cgi_send_headers(sapi_headers_struct *sapi_headers)
err++;
}
if (err->str) {
len = slprintf(buf, sizeof(buf), "Status: %d %s\r\n", SG(sapi_headers).http_response_code, err->str);
len = slprintf(buf, sizeof(buf), "Status: %d %s", SG(sapi_headers).http_response_code, err->str);
} else {
len = slprintf(buf, sizeof(buf), "Status: %d\r\n", SG(sapi_headers).http_response_code);
len = slprintf(buf, sizeof(buf), "Status: %d", SG(sapi_headers).http_response_code);
}
}
}
@@ -433,6 +433,7 @@ static int sapi_cgi_send_headers(sapi_headers_struct *sapi_headers)
if (!has_status) {
PHPWRITE_H(buf, len);
PHPWRITE_H("\r\n", 2);
ignore_status = 1;
}
}

10
sapi/cgi/tests/bug80849-cgi.phpt Normal file
View File

@@ -0,0 +1,10 @@
--TEST--
Bug #80849 (HTTP Status header truncation)
--CGI--
--FILE--
<?php
header('HTTP/1.1 201 ' . str_repeat('A', 1014), true);
?>
--EXPECTHEADERS--
Status: 201 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
--EXPECT--

9
sapi/fpm/fpm/fpm_main.c
View File

@@ -323,7 +323,7 @@ static int sapi_cgi_send_headers(sapi_headers_struct *sapi_headers) /* {{{ */
if (CGIG(rfc2616_headers) && SG(sapi_headers).http_status_line) {
char *s;
len = slprintf(buf, SAPI_CGI_MAX_HEADER_LENGTH, "%s\r\n", SG(sapi_headers).http_status_line);
len = slprintf(buf, SAPI_CGI_MAX_HEADER_LENGTH, "%s", SG(sapi_headers).http_status_line);
if ((s = strchr(SG(sapi_headers).http_status_line, ' '))) {
response_status = atoi((s + 1));
}
@@ -340,7 +340,7 @@ static int sapi_cgi_send_headers(sapi_headers_struct *sapi_headers) /* {{{ */
(s - SG(sapi_headers).http_status_line) >= 5 &&
strncasecmp(SG(sapi_headers).http_status_line, "HTTP/", 5) == 0
) {
len = slprintf(buf, sizeof(buf), "Status:%s\r\n", s);
len = slprintf(buf, sizeof(buf), "Status:%s", s);
response_status = atoi((s + 1));
} else {
h = (sapi_header_struct*)zend_llist_get_first_ex(&sapi_headers->headers, &pos);
@@ -363,9 +363,9 @@ static int sapi_cgi_send_headers(sapi_headers_struct *sapi_headers) /* {{{ */
err++;
}
if (err->str) {
len = slprintf(buf, sizeof(buf), "Status: %d %s\r\n", SG(sapi_headers).http_response_code, err->str);
len = slprintf(buf, sizeof(buf), "Status: %d %s", SG(sapi_headers).http_response_code, err->str);
} else {
len = slprintf(buf, sizeof(buf), "Status: %d\r\n", SG(sapi_headers).http_response_code);
len = slprintf(buf, sizeof(buf), "Status: %d", SG(sapi_headers).http_response_code);
}
}
}
@@ -373,6 +373,7 @@ static int sapi_cgi_send_headers(sapi_headers_struct *sapi_headers) /* {{{ */
if (!has_status) {
PHPWRITE_H(buf, len);
PHPWRITE_H("\r\n", 2);
ignore_status = 1;
}
}

40
sapi/fpm/tests/bug80849-fpm.phpt Normal file
View File

@@ -0,0 +1,40 @@
--TEST--
Bug #80849 (HTTP Status header truncation)
--SKIPIF--
<?php include "skipif.inc"; ?>
--FILE--
<?php
require_once "tester.inc";
$cfg = <<<EOT
[global]
error_log = {{FILE:LOG}}
[unconfined]
listen = {{ADDR}}
pm = dynamic
pm.max_children = 5
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 3
EOT;
$code = <<<EOT
<?php
header('HTTP/1.1 201 ' . str_repeat('A', 1014), true);
EOT;
$tester = new FPM\Tester($cfg, $code);
$tester->start();
$tester->expectLogStartNotices();
$tester
->request()
->expectHeader('Status', '201 ' . str_repeat('A', 1011));
$tester->terminate();
$tester->close();
?>
--CLEAN--
<?php
require_once "tester.inc";
FPM\Tester::clean();
?>
--EXPECT--