[php-src] PHP-8.6: Merge branch 'PHP-8.4' into PHP-8.5

Author: ndossche (ndossche) Date: 2026-10-22T16:37:00+02:00 Commit: https://github.com/php/php-src/commit/17b4c5f4f196e9dba9405aed97edfe3579927d97 Raw diff: https://github.com/php/php-src/commit/17b4c5f4f196e9dba9405aed97edfe3579927d97.diff Merge branch 'PHP-8.4' into PHP-8.5 * PHP-8.4: Fix GH-24508: HTTP wrapper leaks dechunk filter when header parsing fails Changed paths: A ext/standard/tests/http/gh24508.phpt M NEWS M ext/standard/http_fopen_wrapper.c Diff: diff --git a/NEWS b/NEWS index a929d0aa5432..db11f661ca5c 100644 --- a/NEWS +++ b/NEWS @@ -113,6 +113,10 @@ PHP NEWS . Fixed glob() not negating bracket expressions that start with "^". (Nicolas Grekas) +- Streams: + . Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header + parsing fails after Transfer-Encoding). (bercedev) + - Tidy: . Fixed tidy_repair_string(), tidy_repair_file(), tidy::repairString() and tidy::repairFile() rejecting null for $encoding. (lacatoire) diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c index 9f4582aa3eb1..ba954f6448ef 100644 --- a/ext/standard/http_fopen_wrapper.c +++ b/ext/standard/http_fopen_wrapper.c @@ -1262,6 +1262,8 @@ static php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper, if (stream->writepos > stream->readpos) { php_stream_notify_progress_increment(context, stream->writepos - stream->readpos, 0); } + } else if (header_info.transfer_encoding) { + php_stream_filter_free(header_info.transfer_encoding); } return stream; diff --git a/ext/standard/tests/http/gh24508.phpt b/ext/standard/tests/http/gh24508.phpt new file mode 100644 index 000000000000..33f31f474746 --- /dev/null +++ b/ext/standard/tests/http/gh24508.phpt @@ -0,0 +1,20 @@ +--TEST-- +GH-24508 (HTTP wrapper leaks the dechunk filter when header parsing fails after Transfer-Encoding) +--INI-- +allow_url_fopen=1 +--SKIPIF-- +<?php require 'server.inc'; http_server_skipif(); ?> +--FILE-- +<?php +require 'server.inc'; + +['pid' => $pid, 'uri' => $uri] = http_server([ + "data://text/plain,HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nBrokenHeaderNoColon\r\n\r\n", +]); + +var_dump(@file_get_contents($uri)); + +http_server_kill($pid); +?> +--EXPECT-- +bool(false)