[php-src] master: Merge branch 'PHP-8.5' into PHP-8.6

Author: ndossche (ndossche) Date: 2026-10-24T00:42:23+02:00 Commit: https://github.com/php/php-src/commit/4c2924299cf088457cb0bbed973b26ffcfc3e2f5 Raw diff: https://github.com/php/php-src/commit/4c2924299cf088457cb0bbed973b26ffcfc3e2f5.diff Merge branch 'PHP-8.5' into PHP-8.6 * PHP-8.5: Fix GH-24509: HTTP wrapper leaks Location buffer on empty Location header Changed paths: A ext/standard/tests/http/gh24509.phpt M NEWS M ext/standard/http_fopen_wrapper.c Diff: diff --git a/NEWS b/NEWS index 741985a9ca66..01adc8ff2755 100644 --- a/NEWS +++ b/NEWS @@ -28,6 +28,8 @@ PHP NEWS on its FD_SETSIZE failure path). (azjezz) . Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header parsing fails after Transfer-Encoding). (bercedev) + . Fixed bug GH-24509 (HTTP wrapper leaks Location buffer on empty + Location header). (bercedev) - Zlib: . Fixed bug GH-24533 (zlib.lib could not be found because zlib 1.3.2 diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c index 2eadc006a29e..37844ec5e317 100644 --- a/ext/standard/http_fopen_wrapper.c +++ b/ext/standard/http_fopen_wrapper.c @@ -324,7 +324,7 @@ static zend_string *php_stream_http_response_headers_parse(php_stream_wrapper *w zend_string_efree(last_header_line); return NULL; } - if (header_info->location_len == 0) { + if (header_info->location == NULL) { header_info->location = emalloc(last_header_value_len + 1); } else if (header_info->location_len <= last_header_value_len) { header_info->location = erealloc(header_info->location, last_header_value_len + 1); diff --git a/ext/standard/tests/http/gh24509.phpt b/ext/standard/tests/http/gh24509.phpt new file mode 100644 index 000000000000..0de807ad2101 --- /dev/null +++ b/ext/standard/tests/http/gh24509.phpt @@ -0,0 +1,21 @@ +--TEST-- +GH-24509 (HTTP wrapper leaks the Location buffer when an empty Location header is followed by another) +--INI-- +allow_url_fopen=1 +--SKIPIF-- +<?php require 'server.inc'; http_server_skipif(); ?> +--FILE-- +<?php +require 'server.inc'; + +['pid' => $pid, 'uri' => $uri] = http_server([ + "data://text/plain,HTTP/1.1 302 Found\r\nLocation:\r\nLocation: /abcdefghijklmno\r\nContent-Length: 0\r\n\r\n", + "data://text/plain,HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nOK", +]); + +var_dump(file_get_contents($uri)); + +http_server_kill($pid); +?> +--EXPECT-- +string(2) "OK"