summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGustavo André dos Santos Lopes <cataphract@php.net>2012-04-04 08:59:51 (GMT)
committerGustavo André dos Santos Lopes <cataphract@php.net>2012-04-04 08:59:51 (GMT)
commitca58cd01fc329f907a13b82370427715d9c5bf70 (patch)
tree3c8740de989eb238abc60ff6ce8df815dbdec210
parentf7bf83546e1f2edb71ad05bd33e01894a359fe02 (diff)
downloadphp-ca58cd01fc329f907a13b82370427715d9c5bf70.tar.gz
Cherry-pick 4cc74767
Headers: forbid \r and \n also after \0, allow CRLF followed by HT or SP and forbid \0. See bug #60227. Conflicts: ext/standard/tests/general_functions/bug60227.phpt ext/standard/tests/general_functions/bug60227_1.phpt ext/standard/tests/general_functions/bug60227_2.phpt main/SAPI.c
-rw-r--r--ext/standard/tests/general_functions/bug60227_1.phpt2
-rw-r--r--ext/standard/tests/general_functions/bug60227_2.phpt2
-rw-r--r--ext/standard/tests/general_functions/bug60227_3.phpt14
-rw-r--r--ext/standard/tests/general_functions/bug60227_4.phpt14
-rw-r--r--main/SAPI.c29
5 files changed, 49 insertions, 12 deletions
diff --git a/ext/standard/tests/general_functions/bug60227_1.phpt b/ext/standard/tests/general_functions/bug60227_1.phpt
index f95a061..8efe222 100644
--- a/ext/standard/tests/general_functions/bug60227_1.phpt
+++ b/ext/standard/tests/general_functions/bug60227_1.phpt
@@ -10,7 +10,7 @@ header("X-Foo5: e\rSet-Cookie: ID=123");
echo 'foo';
?>
--EXPECTF--
-Warning: Header may not contain more than a single header, new line detected. in %s on line %d
+Warning: Header may not contain more than a single header, new line detected in %s on line %d
foo
--EXPECTHEADERS--
X-Foo1: a
diff --git a/ext/standard/tests/general_functions/bug60227_2.phpt b/ext/standard/tests/general_functions/bug60227_2.phpt
index fd383f3..995c364 100644
--- a/ext/standard/tests/general_functions/bug60227_2.phpt
+++ b/ext/standard/tests/general_functions/bug60227_2.phpt
@@ -7,7 +7,7 @@ header("X-Foo6: e\rSet-Cookie: ID=123\n d");
echo 'foo';
?>
--EXPECTF--
-Warning: Header may not contain more than a single header, new line detected. in %s on line %d
+Warning: Header may not contain more than a single header, new line detected in %s on line %d
foo
--EXPECTHEADERS--
X-foo: e
diff --git a/ext/standard/tests/general_functions/bug60227_3.phpt b/ext/standard/tests/general_functions/bug60227_3.phpt
new file mode 100644
index 0000000..8cba9b8
--- /dev/null
+++ b/ext/standard/tests/general_functions/bug60227_3.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #60227 (header() cannot detect the multi-line header with CR), \0 before \n
+--FILE--
+<?php
+header("X-foo: e\n foo");
+header("X-Foo6: e\0Set-Cookie: ID=\n123\n d");
+echo 'foo';
+?>
+--EXPECTF--
+Warning: Header may not contain NUL bytes in %s on line %d
+foo
+--EXPECTHEADERS--
+X-foo: e
+foo
diff --git a/ext/standard/tests/general_functions/bug60227_4.phpt b/ext/standard/tests/general_functions/bug60227_4.phpt
new file mode 100644
index 0000000..d5e2573
--- /dev/null
+++ b/ext/standard/tests/general_functions/bug60227_4.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #60227 (header() cannot detect the multi-line header with CR), CRLF
+--FILE--
+<?php
+header("X-foo: e\r\n foo");
+header("X-foo: e\r\nfoo");
+echo 'foo';
+?>
+--EXPECTF--
+Warning: Header may not contain more than a single header, new line detected in %s on line %d
+foo
+--EXPECTHEADERS--
+X-foo: e
+ foo
diff --git a/main/SAPI.c b/main/SAPI.c
index e3284cf..df550e0 100644
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -616,17 +616,26 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
return FAILURE;
}
} else {
- /* new line safety check */
- char *s = header_line;
- while ((s = strpbrk(s, "\n\r"))) {
- if (s[1] == ' ' || s[1] == '\t') {
- /* RFC 2616 allows new lines if followed by SP or HT */
- s++;
- continue;
+ /* new line/NUL character safety check */
+ int i;
+ for (i = 0; i < header_line_len; i++) {
+ /* RFC 2616 allows new lines if followed by SP or HT */
+ int illegal_break =
+ (header_line[i+1] != ' ' && header_line[i+1] != '\t')
+ && (
+ header_line[i] == '\n'
+ || (header_line[i] == '\r' && header_line[i+1] != '\n'));
+ if (illegal_break) {
+ efree(header_line);
+ sapi_module.sapi_error(E_WARNING, "Header may not contain "
+ "more than a single header, new line detected");
+ return FAILURE;
+ }
+ if (header_line[i] == '\0') {
+ efree(header_line);
+ sapi_module.sapi_error(E_WARNING, "Header may not contain NUL bytes");
+ return FAILURE;
}
- efree(header_line);
- sapi_module.sapi_error(E_WARNING, "Header may not contain more than a single header, new line detected.");
- return FAILURE;
}
}