Fixed bug #61605 (header_remove() does not remove all headers)

1 files changed, 32 insertions, 6 deletions

diff --git a/main/SAPI.c b/main/SAPI.c
index 693cad3429..99142b4373 100644
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -501,10 +501,36 @@ static void sapi_update_response_code(int ncode TSRMLS_DC)
 	SG(sapi_headers).http_response_code = ncode;
 }
 
-static int sapi_find_matching_header(void *element1, void *element2)
-{
-	int len = strlen((char*)element2);
-	return strncasecmp(((sapi_header_struct*)element1)->header, (char*)element2, len) == 0 && ((sapi_header_struct*)element1)->header[len] == ':';
+/* 
+ * since zend_llist_del_element only remove one matched item once,
+ * we should remove them by ourself
+ */
+static void sapi_remove_header(zend_llist *l, char *name, uint len) {
+	sapi_header_struct *header;
+	zend_llist_element *next;
+	zend_llist_element *current=l->head;
+
+	while (current) {
+		header = (sapi_header_struct *)(current->data);
+		next = current->next;
+		if (header->header_len > len && header->header[len] == ':'
+				&& !strncasecmp(header->header, name, len)) {
+			if (current->prev) {
+				current->prev->next = next;
+			} else {
+				l->head = next;
+			}
+			if (next) {
+				next->prev = current->prev;
+			} else {
+				l->tail = current->prev;
+			}
+			sapi_free_header(header);
+			efree(current);
+			--l->count;
+		}
+		current = next;
+	}
 }
 
 SAPI_API int sapi_add_header_ex(char *header_line, uint header_line_len, zend_bool duplicate, zend_bool replace TSRMLS_DC)
@@ -611,7 +637,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 		if (sapi_module.header_handler) {
 			sapi_module.header_handler(&sapi_header, op, &SG(sapi_headers) TSRMLS_CC);
 		}
-		zend_llist_del_element(&SG(sapi_headers).headers, sapi_header.header, (int(*)(void*, void*))sapi_find_matching_header);
+		sapi_remove_header(&SG(sapi_headers).headers, sapi_header.header, sapi_header.header_len);
 		sapi_free_header(&sapi_header);
 		return SUCCESS;
 	}
@@ -769,7 +795,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 				char sav;
 				sav = *colon_offset;
 				*colon_offset = 0;
-				zend_llist_del_element(&SG(sapi_headers).headers, sapi_header.header, (int(*)(void*, void*))sapi_find_matching_header);
+		        sapi_remove_header(&SG(sapi_headers).headers, sapi_header.header, strlen(sapi_header.header));
 				*colon_offset = sav;
 			}
 		}