svn: /php/php-src/branches/PHP_5_4/ NEWS ext/standard/tests/general_functions/bug60227.phpt main/SAPI.c

hirokawa Thu, 10 Nov 2011 14:24:31 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=318997 Log: MFH: fixed bug #60227 (header() cannot detect the multi-line header with CR(0x0D).) Bug: https://bugs.php.net/60227 (error getting bug information) Changed paths: U php/php-src/branches/PHP_5_4/NEWS A php/php-src/branches/PHP_5_4/ext/standard/tests/general_functions/bug60227.phpt U php/php-src/branches/PHP_5_4/main/SAPI.c Modified: php/php-src/branches/PHP_5_4/NEWS =================================================================== --- php/php-src/branches/PHP_5_4/NEWS 2011-11-10 14:19:06 UTC (rev 318996) +++ php/php-src/branches/PHP_5_4/NEWS 2011-11-10 14:24:31 UTC (rev 318997) @@ -27,6 +27,8 @@ is_a and is_subclass_of). (alan_k) . Fixed bug #60116 (escapeshellcmd() cannot escape the characters which cause shell command injection). (rui) + . Fixed bug #60227 (header() cannot detect the multi-line header with + CR(0x0D)). (rui) - Oracle Database extension (OCI8): . Increased maxium Oracle error message buffer length for new 11.2.0.3 size Added: php/php-src/branches/PHP_5_4/ext/standard/tests/general_functions/bug60227.phpt =================================================================== --- php/php-src/branches/PHP_5_4/ext/standard/tests/general_functions/bug60227.phpt (rev 0) +++ php/php-src/branches/PHP_5_4/ext/standard/tests/general_functions/bug60227.phpt 2011-11-10 14:24:31 UTC (rev 318997) @@ -0,0 +1,20 @@ +--TEST-- +Bug #60227 (header() cannot detect the multi-line header with CR) +--FILE-- +<?php +header("X-Foo1: a"); +header("X-Foo2: b\n "); +header("X-Foo3: c\r\n "); +header("X-Foo4: d\r "); +header("X-Foo5: e\rSet-Cookie: ID=123"); +echo 'foo'; +?> +--EXPECTF-- +Warning: Header may not contain more than a single header, new line detected. in %s on line %d +foo +--EXPECTHEADERS-- +X-Foo1: a +X-Foo2: b +X-Foo3: c +X-Foo4: d + Property changes on: php/php-src/branches/PHP_5_4/ext/standard/tests/general_functions/bug60227.phpt ___________________________________________________________________ Added: svn:keywords + Id Rev Revision Added: svn:eol-style + native Modified: php/php-src/branches/PHP_5_4/main/SAPI.c =================================================================== --- php/php-src/branches/PHP_5_4/main/SAPI.c 2011-11-10 14:19:06 UTC (rev 318996) +++ php/php-src/branches/PHP_5_4/main/SAPI.c 2011-11-10 14:24:31 UTC (rev 318997) @@ -712,7 +712,7 @@ } else { /* new line safety check */ char *s = header_line, *e = header_line + header_line_len, *p; - while (s < e && (p = memchr(s, '\n', (e - s)))) { + while (s < e && ((p = memchr(s, '\n', (e - s))) || (p = memchr(s, '\r', (e - s))))) { if (*(p + 1) == ' ' || *(p + 1) == '\t') { s = p + 1; continue;