[php-src] PR #23721: sapi/cli: fix use-after-free on a case-varying duplicate header

From: Date: Thu, 17 Sep 2026 12:28:37 +0000
Subject: [php-src] PR #23721: sapi/cli: fix use-after-free on a case-varying duplicate header
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-38528@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/23721 Author: lacatoire \php_cli_server_client_save_header()\ stores the same \zend_string\ in both \request.headers\ (keyed by lowercased name) and \request.headers_original_case\ (keyed by the name as sent), without giving the second table its own reference or destructor. A request with a duplicate header whose name differs only in case replaces the entry in \headers\ (freeing the old value) while \headers_original_case\ still points to it, so \apache_request_headers()\/\getallheaders()\ later read freed memory. Gives \headers_original_case\ its own reference and destructor so the two tables no longer share ownership of the same string.

« previous php.git-pulls (#38528) next »