[php-src] master: Fix GH-24508: HTTP wrapper leaks dechunk filter when header parsing fails

Author: berce (bercedev) Committer: ndossche (ndossche) Date: 2026-10-22T16:36:29+02:00 Commit: https://github.com/php/php-src/commit/4fd56dc469fd6496af9c3216390b0baae7d0b2cd Raw diff: https://github.com/php/php-src/commit/4fd56dc469fd6496af9c3216390b0baae7d0b2cd.diff Fix GH-24508: HTTP wrapper leaks dechunk filter when header parsing fails The dechunk filter created for Transfer-Encoding: chunked is only appended to the stream's read filters when a stream comes back. When a later header line fails to parse, the stream is closed and the filter was never freed. Free it when there is no stream to own it. Closes GH-24513. Changed paths: A ext/standard/tests/http/gh24508.phpt M NEWS M ext/standard/http_fopen_wrapper.c Diff: diff --git a/NEWS b/NEWS index 599891f3b598..db88846f75f2 100644 --- a/NEWS +++ b/NEWS @@ -125,6 +125,10 @@ PHP NEWS . Don't share the unserialize() context with enum autoloaders. (Nicolas Grekas) +- Streams: + . Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header + parsing fails after Transfer-Encoding). (bercedev) + - Tidy: . Fixed tidy_repair_string(), tidy_repair_file(), tidy::repairString() and tidy::repairFile() rejecting null for $encoding. (lacatoire) diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c index 687c2f70d4ab..4085a01a955f 100644 --- a/ext/standard/http_fopen_wrapper.c +++ b/ext/standard/http_fopen_wrapper.c @@ -1259,6 +1259,8 @@ static php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper, if (stream->writepos > stream->readpos) { php_stream_notify_progress_increment(context, stream->writepos - stream->readpos, 0); } + } else if (header_info.transfer_encoding) { + php_stream_filter_free(header_info.transfer_encoding); } return stream; diff --git a/ext/standard/tests/http/gh24508.phpt b/ext/standard/tests/http/gh24508.phpt new file mode 100644 index 000000000000..33f31f474746 --- /dev/null +++ b/ext/standard/tests/http/gh24508.phpt @@ -0,0 +1,20 @@ +--TEST-- +GH-24508 (HTTP wrapper leaks the dechunk filter when header parsing fails after Transfer-Encoding) +--INI-- +allow_url_fopen=1 +--SKIPIF-- +<?php require 'server.inc'; http_server_skipif(); ?> +--FILE-- +<?php +require 'server.inc'; + +['pid' => $pid, 'uri' => $uri] = http_server([ + "data://text/plain,HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nBrokenHeaderNoColon\r\n\r\n", +]); + +var_dump(@file_get_contents($uri)); + +http_server_kill($pid); +?> +--EXPECT-- +bool(false)