[php-src] PR #24543: Fix GH-24536: Built-in server crashes on a huge chunk size or Content-Length
| From: | lazerg | Date: | Thu, 22 Oct 2026 14:40:47 +0000 |
| Subject: | [php-src] PR #24543: Fix GH-24536: Built-in server crashes on a huge chunk size or Content-Length | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39709@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24543
Author: lazerg
The first
on_body call pre-allocated parser->content_length bytes,
which is whatever size the client declared. A chunk size of FFFFFFFFFFFFFFFF wraps to
-1 and becomes a SIZE_MAX allocation, but a valid huge size like
7FFFFFFFFFFFFFFF or Content-Length: 9000000000000000000 kills the server
the same way. The buffer was shrunk by the perealloc() right after anyway, so I dropped
the pre-allocation and let perealloc() grow the buffer from NULL.
Fixes GH-24536