Fixed bug #41983 (Error Fetching http headers terminated by '\n')

1 files changed, 34 insertions, 9 deletions

diff --git a/ext/soap/php_http.c b/ext/soap/php_http.c
index c816d21788..40bba74d61 100644
--- a/ext/soap/php_http.c
+++ b/ext/soap/php_http.c
@@ -1153,17 +1153,19 @@ static char *get_http_header_value(char *headers, char *type)
 
 			/* match */
 			tmp = pos + typelen;
-			eol = strstr(tmp, "\r\n");
+			eol = strchr(tmp, '\n');
 			if (eol == NULL) {
 				eol = headers + headerslen;
+			} else if (eol > tmp && *(eol-1) == '\r') {
+				eol--;
 			}
 			return estrndup(tmp, eol - tmp);
 		}
 
 		/* find next line */
-		pos = strstr(pos, "\r\n");
+		pos = strchr(pos, '\n');
 		if (pos) {
-			pos += 2;
+			pos++;
 		}
 
 	} while (pos);
@@ -1203,7 +1205,7 @@ static int get_http_body(php_stream *stream, int close, char *headers,  char **r
 	}
 
 	if (header_chunked) {
-		char done, chunk_size[10];
+		char ch, done, chunk_size[10], headerbuf[8192];
 
 		done = FALSE;
 
@@ -1231,11 +1233,20 @@ static int get_http_body(php_stream *stream, int close, char *headers,  char **r
 						len_size += len_read;
 	 					http_buf_size += len_read;
  					}
- 				}
 
-				/* Eat up '\r' '\n' */
-				php_stream_getc(stream);
-				php_stream_getc(stream);
+					/* Eat up '\r' '\n' */
+					ch = php_stream_getc(stream);
+					if (ch == '\r') {
+						ch = php_stream_getc(stream);
+					}
+					if (ch != '\n') {
+						/* Somthing wrong in chunked encoding */
+						if (http_buf) {
+							efree(http_buf);
+						}
+						return FALSE;
+					}
+ 				}
 			} else {
 				/* Somthing wrong in chunked encoding */
 				if (http_buf) {
@@ -1248,6 +1259,19 @@ static int get_http_body(php_stream *stream, int close, char *headers,  char **r
 			}
 		}
 
+		/* Ignore trailer headers */
+		while (1) {
+			if (!php_stream_gets(stream, headerbuf, sizeof(headerbuf))) {
+				break;
+			}
+
+			if ((headerbuf[0] == '\r' && headerbuf[1] == '\n') ||
+			    (headerbuf[0] == '\n')) {
+				/* empty line marks end of headers */
+				break;
+			}
+		}
+
 		if (http_buf == NULL) {
 			http_buf = emalloc(1);
 		}
@@ -1294,7 +1318,8 @@ static int get_http_headers(php_stream *stream, char **response, int *out_size T
 			break;
 		}
 
-		if (strcmp(headerbuf, "\r\n") == 0) {
+		if ((headerbuf[0] == '\r' && headerbuf[1] == '\n') ||
+		    (headerbuf[0] == '\n')) {
 			/* empty line marks end of headers */
 			done = TRUE;
 			break;