diff options
author | Stanislav Malyshev <stas@php.net> | 2018-02-20 15:34:43 -0800 |
---|---|---|
committer | Stanislav Malyshev <stas@php.net> | 2018-02-26 22:25:51 -0800 |
commit | 523f230c831d7b33353203fa34aee4e92ac12bba (patch) | |
tree | 09ba7eef6800786eb6821b9c9ad4fd5a72d74b8c /ext/standard/tests/http | |
parent | 1f4b057b631f9c9672cfd180090d8f52197bf806 (diff) | |
download | php-git-523f230c831d7b33353203fa34aee4e92ac12bba.tar.gz |
Fix bug #75981: prevent reading beyond buffer start
Diffstat (limited to 'ext/standard/tests/http')
-rw-r--r-- | ext/standard/tests/http/bug75981.phpt | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/ext/standard/tests/http/bug75981.phpt b/ext/standard/tests/http/bug75981.phpt new file mode 100644 index 0000000000..d415de66b9 --- /dev/null +++ b/ext/standard/tests/http/bug75981.phpt @@ -0,0 +1,32 @@ +--TEST-- +Bug #75981 (stack-buffer-overflow while parsing HTTP response) +--INI-- +allow_url_fopen=1 +--SKIPIF-- +<?php require 'server.inc'; http_server_skipif('tcp://127.0.0.1:12342'); ?> +--FILE-- +<?php +require 'server.inc'; + +$options = [ + 'http' => [ + 'protocol_version' => '1.1', + 'header' => 'Connection: Close' + ], +]; + +$ctx = stream_context_create($options); + +$responses = [ + "data://text/plain,000000000100\xA\xA" +]; +$pid = http_server('tcp://127.0.0.1:12342', $responses); + +echo @file_get_contents('http://127.0.0.1:12342/', false, $ctx); + +http_server_kill($pid); + +?> +DONE +--EXPECT-- +DONE |