diff options
| author | Rui Hirokawa <hirokawa@php.net> | 2011-11-10 14:24:31 +0000 |
|---|---|---|
| committer | Rui Hirokawa <hirokawa@php.net> | 2011-11-10 14:24:31 +0000 |
| commit | cc74264764df336fbc1e5520eb4e5e6f74ccc8d9 (patch) | |
| tree | a3bfb470eabed7087a44b4171d2bc1e2a2ef1a7d | |
| parent | db5d9c0b6693ce29278d0b58cb30a55c48f84d4f (diff) | |
| download | php-git-cc74264764df336fbc1e5520eb4e5e6f74ccc8d9.tar.gz | |
MFH: fixed bug #60227 (header() cannot detect the multi-line header with CR(0x0D).)
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/standard/tests/general_functions/bug60227.phpt | 20 | ||||
| -rw-r--r-- | main/SAPI.c | 2 |
3 files changed, 23 insertions, 1 deletions
@@ -27,6 +27,8 @@ PHP NEWS is_a and is_subclass_of). (alan_k) . Fixed bug #60116 (escapeshellcmd() cannot escape the characters which cause shell command injection). (rui) + . Fixed bug #60227 (header() cannot detect the multi-line header with + CR(0x0D)). (rui) - Oracle Database extension (OCI8): . Increased maxium Oracle error message buffer length for new 11.2.0.3 size diff --git a/ext/standard/tests/general_functions/bug60227.phpt b/ext/standard/tests/general_functions/bug60227.phpt new file mode 100644 index 0000000000..f95a061d2c --- /dev/null +++ b/ext/standard/tests/general_functions/bug60227.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #60227 (header() cannot detect the multi-line header with CR) +--FILE-- +<?php +header("X-Foo1: a"); +header("X-Foo2: b\n "); +header("X-Foo3: c\r\n "); +header("X-Foo4: d\r "); +header("X-Foo5: e\rSet-Cookie: ID=123"); +echo 'foo'; +?> +--EXPECTF-- +Warning: Header may not contain more than a single header, new line detected. in %s on line %d +foo +--EXPECTHEADERS-- +X-Foo1: a +X-Foo2: b +X-Foo3: c +X-Foo4: d + diff --git a/main/SAPI.c b/main/SAPI.c index 577247012b..f112712b66 100644 --- a/main/SAPI.c +++ b/main/SAPI.c @@ -712,7 +712,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC) } else { /* new line safety check */ char *s = header_line, *e = header_line + header_line_len, *p; - while (s < e && (p = memchr(s, '\n', (e - s)))) { + while (s < e && ((p = memchr(s, '\n', (e - s))) || (p = memchr(s, '\r', (e - s))))) { if (*(p + 1) == ' ' || *(p + 1) == '\t') { s = p + 1; continue; |