svn: /php/php-src/trunk/ ext/standard/tests/general_functions/bug60227_1.phpt ext/standard/tests/general_functions/bug60227_2.phpt
ext/standard/tests/general_functions/bug60227_3.phpt ext/standard/tests/general_functions/bug60227_4.phpt main/SAPI.c

cataphract Fri, 03 Feb 2012 13:56:37 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=323043 Log: - Headers: forbid \r and \n also after \0, allow CRLF followed by HT or SP and forbid \0. See bug #60227. Bug: https://bugs.php.net/60227 (Closed) header() cannot detect the multi-line header with CR(0x0D). Changed paths: U php/php-src/trunk/ext/standard/tests/general_functions/bug60227_1.phpt U php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt A + php/php-src/trunk/ext/standard/tests/general_functions/bug60227_3.phpt (from php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt:r323040) A + php/php-src/trunk/ext/standard/tests/general_functions/bug60227_4.phpt (from php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt:r323040) U php/php-src/trunk/main/SAPI.c Modified: php/php-src/trunk/ext/standard/tests/general_functions/bug60227_1.phpt =================================================================== --- php/php-src/trunk/ext/standard/tests/general_functions/bug60227_1.phpt 2012-02-03 11:35:15 UTC (rev 323042) +++ php/php-src/trunk/ext/standard/tests/general_functions/bug60227_1.phpt 2012-02-03 13:56:37 UTC (rev 323043) @@ -10,7 +10,7 @@ echo 'foo'; ?> --EXPECTF-- -Warning: Header may not contain more than a single header, new line detected. in %s on line %d +Warning: Header may not contain more than a single header, new line detected in %s on line %d foo --EXPECTHEADERS-- X-Foo1: a Modified: php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt =================================================================== --- php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt 2012-02-03 11:35:15 UTC (rev 323042) +++ php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt 2012-02-03 13:56:37 UTC (rev 323043) @@ -7,7 +7,7 @@ echo 'foo'; ?> --EXPECTF-- -Warning: Header may not contain more than a single header, new line detected. in %s on line %d +Warning: Header may not contain more than a single header, new line detected in %s on line %d foo --EXPECTHEADERS-- X-foo: e Copied: php/php-src/trunk/ext/standard/tests/general_functions/bug60227_3.phpt (from rev 323040, php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt) =================================================================== --- php/php-src/trunk/ext/standard/tests/general_functions/bug60227_3.phpt (rev 0) +++ php/php-src/trunk/ext/standard/tests/general_functions/bug60227_3.phpt 2012-02-03 13:56:37 UTC (rev 323043) @@ -0,0 +1,14 @@ +--TEST-- +Bug #60227 (header() cannot detect the multi-line header with CR), \0 before \n +--FILE-- +<?php +header("X-foo: e\n foo"); +header("X-Foo6: e\0Set-Cookie: ID=\n123\n d"); +echo 'foo'; +?> +--EXPECTF-- +Warning: Header may not contain NUL bytes in %s on line %d +foo +--EXPECTHEADERS-- +X-foo: e +foo Copied: php/php-src/trunk/ext/standard/tests/general_functions/bug60227_4.phpt (from rev 323040, php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt) =================================================================== --- php/php-src/trunk/ext/standard/tests/general_functions/bug60227_4.phpt (rev 0) +++ php/php-src/trunk/ext/standard/tests/general_functions/bug60227_4.phpt 2012-02-03 13:56:37 UTC (rev 323043) @@ -0,0 +1,14 @@ +--TEST-- +Bug #60227 (header() cannot detect the multi-line header with CR), CRLF +--FILE-- +<?php +header("X-foo: e\r\n foo"); +header("X-foo: e\r\nfoo"); +echo 'foo'; +?> +--EXPECTF-- +Warning: Header may not contain more than a single header, new line detected in %s on line %d +foo +--EXPECTHEADERS-- +X-foo: e + foo Modified: php/php-src/trunk/main/SAPI.c =================================================================== --- php/php-src/trunk/main/SAPI.c 2012-02-03 11:35:15 UTC (rev 323042) +++ php/php-src/trunk/main/SAPI.c 2012-02-03 13:56:37 UTC (rev 323043) @@ -710,17 +710,26 @@ efree(header_line); return SUCCESS; } else { - /* new line safety check */ - char *s = header_line; - while (s = strpbrk(s, "\n\r")) { - if (s[1] == ' ' || s[1] == '\t') { - /* RFC 2616 allows new lines if followed by SP or HT */ - s++; - continue; + /* new line/NUL character safety check */ + int i; + for (i = 0; i < header_line_len; i++) { + /* RFC 2616 allows new lines if followed by SP or HT */ + int illegal_break = + (header_line[i+1] != ' ' && header_line[i+1] != '\t') + && ( + header_line[i] == '\n' + || (header_line[i] == '\r' && header_line[i+1] != '\n')); + if (illegal_break) { + efree(header_line); + sapi_module.sapi_error(E_WARNING, "Header may not contain " + "more than a single header, new line detected"); + return FAILURE; } - efree(header_line); - sapi_module.sapi_error(E_WARNING, "Header may not contain more than a single header, new line detected."); - return FAILURE; + if (header_line[i] == '\0') { + efree(header_line); + sapi_module.sapi_error(E_WARNING, "Header may not contain NUL bytes"); + return FAILURE; + } } }