[php-src] PR #23721: sapi/cli: fix use-after-free on a case-varying duplicate header
| From: | lacatoire | Date: | Thu, 17 Sep 2026 12:28:37 +0000 |
| Subject: | [php-src] PR #23721: sapi/cli: fix use-after-free on a case-varying duplicate header | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38528@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23721
Author: lacatoire
\
php_cli_server_client_save_header()\ stores the same \zend_string\ in
both \request.headers\ (keyed by lowercased name) and
\request.headers_original_case\ (keyed by the name as sent), without giving the second
table its own reference or destructor.
A request with a duplicate header whose name differs only in case replaces the entry in
\headers\ (freeing the old value) while \headers_original_case\ still
points to it, so \apache_request_headers()\/\getallheaders()\ later read
freed memory.
Gives \headers_original_case\ its own reference and destructor so the two tables no
longer share ownership of the same string.