Cherry-pick 4cc74767

Headers: forbid \r and \n also after \0, allow CRLF followed by HT or SP and forbid \0. See bug #60227.

Conflicts:

	ext/standard/tests/general_functions/bug60227.phpt
	ext/standard/tests/general_functions/bug60227_1.phpt
	ext/standard/tests/general_functions/bug60227_2.phpt
	main/SAPI.c

1 files changed, 19 insertions, 10 deletions

diff --git a/main/SAPI.c b/main/SAPI.c
index e3284cfcf3..df550e0249 100644
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -616,17 +616,26 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 			return FAILURE;
 		}
 	} else {
-		/* new line safety check */
-		char *s = header_line;
-		while ((s = strpbrk(s, "\n\r"))) {
-			if (s[1] == ' ' || s[1] == '\t') {
-				/* RFC 2616 allows new lines if followed by SP or HT */
-				s++;
-				continue;
+		/* new line/NUL character safety check */
+		int i;
+		for (i = 0; i < header_line_len; i++) {
+			/* RFC 2616 allows new lines if followed by SP or HT */
+			int illegal_break =
+					(header_line[i+1] != ' ' && header_line[i+1] != '\t')
+					&& (
+						header_line[i] == '\n'
+						|| (header_line[i] == '\r' && header_line[i+1] != '\n'));
+			if (illegal_break) {
+				efree(header_line);
+				sapi_module.sapi_error(E_WARNING, "Header may not contain "
+						"more than a single header, new line detected");
+				return FAILURE;
+			}
+			if (header_line[i] == '\0') {
+				efree(header_line);
+				sapi_module.sapi_error(E_WARNING, "Header may not contain NUL bytes");
+				return FAILURE;
 			}
-			efree(header_line);
-			sapi_module.sapi_error(E_WARNING, "Header may not contain more than a single header, new line detected.");
-			return FAILURE;
 		}
 	}