[php-src] PR #25049: Fix GH-24115: CLI server chunked trailers bypass header size limit

From: Date: Fri, 30 Oct 2026 07:17:59 +0000
Subject: [php-src] PR #25049: Fix GH-24115: CLI server chunked trailers bypass header size limit
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-40080@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/25049 Author: glbessa Fixes GH-24115. PARSING_HEADER() in sapi/cli/php_http_parser.c excluded the F_TRAILING state, so the bytes of chunked request trailers were never counted in nread, and PHP_HTTP_MAX_HEADER_SIZE did not apply to them. A client could send an unbounded trailer section after the 0\r\n chunk. The fix drops the F_TRAILING exception, so trailers are counted like regular headers. This is the same change upstream nodejs/http-parser made in 81ca70aec ("Avoid chunk trailer overflow"). Notes: - nread is reset at the end of the regular headers, so trailers get their own 80 KB budget. Chunk sizes and chunk data are not counted. - At the end of the trailers, nread is not reset before NEW_MESSAGE(). This does not matter today because the CLI server always replies with Connection: close. I can add a reset there if you prefer. Test: sapi/cli/tests/gh24115.phpt sends a small trailer (200), a 100 KB trailer (rejected), and then checks that the server still answers. The test fails without the fix. I also ran a short randomized check with chunked bodies up to 200 KB and trailers up to 160 KB, and every response matched the limit. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

« previous php.git-pulls (#40080) next »