[php-src] PHP-8.4: Fix GH-24509: HTTP wrapper leaks Location buffer on empty Location header

Author: berce (bercedev) Committer: ndossche (ndossche) Date: 2026-10-24T00:41:40+02:00 Commit: https://github.com/php/php-src/commit/ad7ad7c425ae816426ed88f2540b0be3626f4222 Raw diff: https://github.com/php/php-src/commit/ad7ad7c425ae816426ed88f2540b0be3626f4222.diff Fix GH-24509: HTTP wrapper leaks Location buffer on empty Location header location_len == 0 was used to mean that no buffer was allocated yet, but an empty Location header allocates a 1-byte buffer and leaves location_len at 0. A second Location header then allocated a new buffer and leaked the first. Check the pointer instead. Closes GH-24512. Changed paths: A ext/standard/tests/http/gh24509.phpt M NEWS M ext/standard/http_fopen_wrapper.c Diff: diff --git a/NEWS b/NEWS index a70e913cd499..6d09ce4a22cc 100644 --- a/NEWS +++ b/NEWS @@ -150,6 +150,8 @@ PHP NEWS - Streams: . Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header parsing fails after Transfer-Encoding). (bercedev) + . Fixed bug GH-24509 (HTTP wrapper leaks Location buffer on empty + Location header). (bercedev) - Tidy: . Fixed tidy_repair_string(), tidy_repair_file(), tidy::repairString() and diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c index 4085a01a955f..1d6c551bc8ce 100644 --- a/ext/standard/http_fopen_wrapper.c +++ b/ext/standard/http_fopen_wrapper.c @@ -335,7 +335,7 @@ static zend_string *php_stream_http_response_headers_parse(php_stream_wrapper *w zend_string_efree(last_header_line_str); return NULL; } - if (header_info->location_len == 0) { + if (header_info->location == NULL) { header_info->location = emalloc(last_header_value_len + 1); } else if (header_info->location_len <= last_header_value_len) { header_info->location = erealloc(header_info->location, last_header_value_len + 1); diff --git a/ext/standard/tests/http/gh24509.phpt b/ext/standard/tests/http/gh24509.phpt new file mode 100644 index 000000000000..0de807ad2101 --- /dev/null +++ b/ext/standard/tests/http/gh24509.phpt @@ -0,0 +1,21 @@ +--TEST-- +GH-24509 (HTTP wrapper leaks the Location buffer when an empty Location header is followed by another) +--INI-- +allow_url_fopen=1 +--SKIPIF-- +<?php require 'server.inc'; http_server_skipif(); ?> +--FILE-- +<?php +require 'server.inc'; + +['pid' => $pid, 'uri' => $uri] = http_server([ + "data://text/plain,HTTP/1.1 302 Found\r\nLocation:\r\nLocation: /abcdefghijklmno\r\nContent-Length: 0\r\n\r\n", + "data://text/plain,HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nOK", +]); + +var_dump(file_get_contents($uri)); + +http_server_kill($pid); +?> +--EXPECT-- +string(2) "OK"