[php-src] PR #25049: Fix GH-24115: CLI server chunked trailers bypass header size limit
| From: | glbessa | Date: | Fri, 30 Oct 2026 07:17:59 +0000 |
| Subject: | [php-src] PR #25049: Fix GH-24115: CLI server chunked trailers bypass header size limit | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40080@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25049
Author: glbessa
Fixes GH-24115.
PARSING_HEADER() in sapi/cli/php_http_parser.c excluded the
F_TRAILING state, so the bytes of chunked request trailers were never counted in
nread, and PHP_HTTP_MAX_HEADER_SIZE did not apply to them. A client could
send an unbounded trailer section after the 0\r\n chunk.
The fix drops the F_TRAILING exception, so trailers are counted like regular headers.
This is the same change upstream nodejs/http-parser made in 81ca70aec ("Avoid chunk trailer
overflow").
Notes:
- nread is reset at the end of the regular headers, so trailers get their own 80 KB
budget. Chunk sizes and chunk data are not counted.
- At the end of the trailers, nread is not reset before NEW_MESSAGE().
This does not matter today because the CLI server always replies with Connection:
close. I can add a reset there if you prefer.
Test: sapi/cli/tests/gh24115.phpt sends a small trailer (200), a 100 KB trailer
(rejected), and then checks that the server still answers. The test fails without the fix. I also
ran a short randomized check with chunked bodies up to 200 KB and trailers up to 160 KB, and every
response matched the limit.
🤖 Generated with [Claude Code](https://claude.com/claude-code)