[php-src] master: Merge branch 'PHP-8.4' into PHP-8.5

Author: Weilin Du (LamentXU123) Date: 2026-10-23T00:57:33+08:00 Commit: https://github.com/php/php-src/commit/a31088718703a735a26e05b467786679eb17bb5e Raw diff: https://github.com/php/php-src/commit/a31088718703a735a26e05b467786679eb17bb5e.diff Merge branch 'PHP-8.4' into PHP-8.5 * PHP-8.4: Fix infinite loop in sapi_header_op() for headers of 4 GiB or more (#24540) Changed paths: A ext/standard/tests/general_functions/header_over_4gib.phpt M NEWS M main/SAPI.c Diff: diff --git a/NEWS b/NEWS index 580bb240df90..76155467a42a 100644 --- a/NEWS +++ b/NEWS @@ -100,6 +100,10 @@ PHP NEWS . Fixed a crash in readline_info() when completion_append_character contains a non-ASCII byte. (Weilin Du) +- SAPI: + . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more. + (Martin Mirchev) + - Session: . Fixed session data loss in the files save handler when writing the session file fails after it was already truncated. (Ilia Alshanetsky) diff --git a/ext/standard/tests/general_functions/header_over_4gib.phpt b/ext/standard/tests/general_functions/header_over_4gib.phpt new file mode 100644 index 000000000000..a2075dfb27cd --- /dev/null +++ b/ext/standard/tests/general_functions/header_over_4gib.phpt @@ -0,0 +1,20 @@ +--TEST-- +header() with a header line longer than 4 GiB +--SKIPIF-- +<?php +if (!getenv('RUN_RESOURCE_HEAVY_TESTS')) die('skip resource-heavy test'); +if (PHP_INT_SIZE != 8) die('skip this test is for 64bit platforms only'); +if (getenv('SKIP_SLOW_TESTS')) die('skip slow tests excluded by request'); +?> +--INI-- +memory_limit=-1 +--FILE-- +<?php +// The new line/NUL check in sapi_header_op() used a 32-bit index, so a header +// line of 4 GiB or more made it loop forever. +header('X-Foo: ' . str_repeat('a', 2**32) . "\nX-Bar: b"); +echo "Done\n"; +?> +--EXPECTF-- +Warning: Header may not contain more than a single header, new line detected in %s on line %d +Done diff --git a/main/SAPI.c b/main/SAPI.c index 3ad6eb24a348..4fa31ab33f7d 100644 --- a/main/SAPI.c +++ b/main/SAPI.c @@ -760,7 +760,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg) return SUCCESS; } else { /* new line/NUL character safety check */ - uint32_t i; + size_t i; for (i = 0; i < header_line_len; i++) { /* RFC 7230 ch. 3.2.4 deprecates folding support */ if (header_line[i] == '\n' || header_line[i] == '\r') {