[php-src] master: Merge branch 'PHP-8.6'

Author: Weilin Du (LamentXU123) Date: 2026-10-23T00:58:24+08:00 Commit: https://github.com/php/php-src/commit/e7593aed8717d3805cec4f04ab81c1a104922566 Raw diff: https://github.com/php/php-src/commit/e7593aed8717d3805cec4f04ab81c1a104922566.diff Merge branch 'PHP-8.6' * PHP-8.6: Fix infinite loop in sapi_header_op() for headers of 4 GiB or more (#24540) Changed paths: A ext/standard/tests/general_functions/header_over_4gib.phpt M main/SAPI.c Diff: diff --git a/ext/standard/tests/general_functions/header_over_4gib.phpt b/ext/standard/tests/general_functions/header_over_4gib.phpt new file mode 100644 index 000000000000..a2075dfb27cd --- /dev/null +++ b/ext/standard/tests/general_functions/header_over_4gib.phpt @@ -0,0 +1,20 @@ +--TEST-- +header() with a header line longer than 4 GiB +--SKIPIF-- +<?php +if (!getenv('RUN_RESOURCE_HEAVY_TESTS')) die('skip resource-heavy test'); +if (PHP_INT_SIZE != 8) die('skip this test is for 64bit platforms only'); +if (getenv('SKIP_SLOW_TESTS')) die('skip slow tests excluded by request'); +?> +--INI-- +memory_limit=-1 +--FILE-- +<?php +// The new line/NUL check in sapi_header_op() used a 32-bit index, so a header +// line of 4 GiB or more made it loop forever. +header('X-Foo: ' . str_repeat('a', 2**32) . "\nX-Bar: b"); +echo "Done\n"; +?> +--EXPECTF-- +Warning: Header may not contain more than a single header, new line detected in %s on line %d +Done diff --git a/main/SAPI.c b/main/SAPI.c index 65fafac28873..6b9ef7bf1a3e 100644 --- a/main/SAPI.c +++ b/main/SAPI.c @@ -732,7 +732,7 @@ SAPI_API zend_result sapi_header_op(sapi_header_op_enum op, void *arg) return SUCCESS; } else { /* new line/NUL character safety check */ - uint32_t i; + size_t i; for (i = 0; i < header_line_len; i++) { /* RFC 7230 ch. 3.2.4 deprecates folding support */ if (header_line[i] == '\n' || header_line[i] == '\r') {