[php-src] PR #24512: Fix GH-24509: HTTP wrapper leaks Location buffer on empty Location header
| From: | bercedev | Date: | Wed, 21 Oct 2026 21:37:02 +0000 |
| Subject: | [php-src] PR #24512: Fix GH-24509: HTTP wrapper leaks Location buffer on empty Location header | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39680@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24512
Author: bercedev
Fixes GH-24509
php_stream_http_response_headers_parse() used location_len == 0 to mean
"no Location buffer allocated yet". An empty Location: header allocates a
1-byte buffer and leaves location_len at 0, so a later Location: header
took the emalloc() branch again and leaked the first buffer. It now checks
header_info->location == NULL. The struct is zeroed by
php_stream_http_response_header_info_init(), and the pointer is set back to NULL
wherever the buffer is handed off or freed.
The new ext/standard/tests/http/gh24509.phpt sends Location: followed by
Location: /abcdefghijklmno, then follows the redirect. On a debug build
(--enable-debug --enable-pcntl --enable-posix) of PHP-8.4 without the fix it fails
with:
```
ext/standard/http_fopen_wrapper.c(339) : Freeing 0x... (16 bytes), script=.../gh24509.php
=== Total 1 memory leaks detected ===
```
With the fix it passes, and ext/standard/tests/http/ gives 71 passed, 14 skipped, 0
failed.
I targeted PHP-8.4 because the same code is there.