[php-src] master: Merge branch 'PHP-8.6'

Author: ndossche (ndossche) Date: 2026-10-24T00:42:28+02:00 Commit: https://github.com/php/php-src/commit/45869fa68a91557d4a798d8219f5b938bc21fd70 Raw diff: https://github.com/php/php-src/commit/45869fa68a91557d4a798d8219f5b938bc21fd70.diff Merge branch 'PHP-8.6' * PHP-8.6: Fix GH-24509: HTTP wrapper leaks Location buffer on empty Location header Changed paths: A ext/standard/tests/http/gh24509.phpt M ext/standard/http_fopen_wrapper.c Diff: diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c index 2eadc006a29e..37844ec5e317 100644 --- a/ext/standard/http_fopen_wrapper.c +++ b/ext/standard/http_fopen_wrapper.c @@ -324,7 +324,7 @@ static zend_string *php_stream_http_response_headers_parse(php_stream_wrapper *w zend_string_efree(last_header_line); return NULL; } - if (header_info->location_len == 0) { + if (header_info->location == NULL) { header_info->location = emalloc(last_header_value_len + 1); } else if (header_info->location_len <= last_header_value_len) { header_info->location = erealloc(header_info->location, last_header_value_len + 1); diff --git a/ext/standard/tests/http/gh24509.phpt b/ext/standard/tests/http/gh24509.phpt new file mode 100644 index 000000000000..0de807ad2101 --- /dev/null +++ b/ext/standard/tests/http/gh24509.phpt @@ -0,0 +1,21 @@ +--TEST-- +GH-24509 (HTTP wrapper leaks the Location buffer when an empty Location header is followed by another) +--INI-- +allow_url_fopen=1 +--SKIPIF-- +<?php require 'server.inc'; http_server_skipif(); ?> +--FILE-- +<?php +require 'server.inc'; + +['pid' => $pid, 'uri' => $uri] = http_server([ + "data://text/plain,HTTP/1.1 302 Found\r\nLocation:\r\nLocation: /abcdefghijklmno\r\nContent-Length: 0\r\n\r\n", + "data://text/plain,HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nOK", +]); + +var_dump(file_get_contents($uri)); + +http_server_kill($pid); +?> +--EXPECT-- +string(2) "OK"