diff options
Diffstat (limited to 'main/SAPI.c')
| -rw-r--r-- | main/SAPI.c | 29 |
1 files changed, 19 insertions, 10 deletions
diff --git a/main/SAPI.c b/main/SAPI.c index 271fd21839..936aee91c7 100644 --- a/main/SAPI.c +++ b/main/SAPI.c @@ -590,17 +590,26 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC) return FAILURE; } } else { - /* new line safety check */ - char *s = header_line; - while (s = strpbrk(s, "\n\r")) { - if (s[1] == ' ' || s[1] == '\t') { - /* RFC 2616 allows new lines if followed by SP or HT */ - s++; - continue; + /* new line/NUL character safety check */ + int i; + for (i = 0; i < header_line_len; i++) { + /* RFC 2616 allows new lines if followed by SP or HT */ + int illegal_break = + (header_line[i+1] != ' ' && header_line[i+1] != '\t') + && ( + header_line[i] == '\n' + || (header_line[i] == '\r' && header_line[i+1] != '\n')); + if (illegal_break) { + efree(header_line); + sapi_module.sapi_error(E_WARNING, "Header may not contain " + "more than a single header, new line detected"); + return FAILURE; + } + if (header_line[i] == '\0') { + efree(header_line); + sapi_module.sapi_error(E_WARNING, "Header may not contain NUL bytes"); + return FAILURE; } - efree(header_line); - sapi_module.sapi_error(E_WARNING, "Header may not contain more than a single header, new line detected."); - return FAILURE; } } |