cataphract                               Fri, 03 Feb 2012 13:56:37 +0000

Revision: http://svn.php.net/viewvc?view=revision&revision=323043

Log:
- Headers: forbid \r and \n also after \0, allow CRLF followed by HT or SP and
  forbid \0. See bug #60227.

Bug: https://bugs.php.net/60227 (Closed) header() cannot detect the multi-line 
header with CR(0x0D).
      
Changed paths:
    U   php/php-src/trunk/ext/standard/tests/general_functions/bug60227_1.phpt
    U   php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt
    A + php/php-src/trunk/ext/standard/tests/general_functions/bug60227_3.phpt
        (from 
php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt:r323040)
    A + php/php-src/trunk/ext/standard/tests/general_functions/bug60227_4.phpt
        (from 
php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt:r323040)
    U   php/php-src/trunk/main/SAPI.c

Modified: php/php-src/trunk/ext/standard/tests/general_functions/bug60227_1.phpt
===================================================================
--- php/php-src/trunk/ext/standard/tests/general_functions/bug60227_1.phpt      
2012-02-03 11:35:15 UTC (rev 323042)
+++ php/php-src/trunk/ext/standard/tests/general_functions/bug60227_1.phpt      
2012-02-03 13:56:37 UTC (rev 323043)
@@ -10,7 +10,7 @@
 echo 'foo';
 ?>
 --EXPECTF--
-Warning: Header may not contain more than a single header, new line detected. 
in %s on line %d
+Warning: Header may not contain more than a single header, new line detected 
in %s on line %d
 foo
 --EXPECTHEADERS--
 X-Foo1: a

Modified: php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt
===================================================================
--- php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt      
2012-02-03 11:35:15 UTC (rev 323042)
+++ php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt      
2012-02-03 13:56:37 UTC (rev 323043)
@@ -7,7 +7,7 @@
 echo 'foo';
 ?>
 --EXPECTF--
-Warning: Header may not contain more than a single header, new line detected. 
in %s on line %d
+Warning: Header may not contain more than a single header, new line detected 
in %s on line %d
 foo
 --EXPECTHEADERS--
 X-foo: e

Copied: php/php-src/trunk/ext/standard/tests/general_functions/bug60227_3.phpt 
(from rev 323040, 
php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt)
===================================================================
--- php/php-src/trunk/ext/standard/tests/general_functions/bug60227_3.phpt      
                        (rev 0)
+++ php/php-src/trunk/ext/standard/tests/general_functions/bug60227_3.phpt      
2012-02-03 13:56:37 UTC (rev 323043)
@@ -0,0 +1,14 @@
+--TEST--
+Bug #60227 (header() cannot detect the multi-line header with CR), \0 before \n
+--FILE--
+<?php
+header("X-foo: e\n foo");
+header("X-Foo6: e\0Set-Cookie: ID=\n123\n d");
+echo 'foo';
+?>
+--EXPECTF--
+Warning: Header may not contain NUL bytes in %s on line %d
+foo
+--EXPECTHEADERS--
+X-foo: e
+foo

Copied: php/php-src/trunk/ext/standard/tests/general_functions/bug60227_4.phpt 
(from rev 323040, 
php/php-src/trunk/ext/standard/tests/general_functions/bug60227_2.phpt)
===================================================================
--- php/php-src/trunk/ext/standard/tests/general_functions/bug60227_4.phpt      
                        (rev 0)
+++ php/php-src/trunk/ext/standard/tests/general_functions/bug60227_4.phpt      
2012-02-03 13:56:37 UTC (rev 323043)
@@ -0,0 +1,14 @@
+--TEST--
+Bug #60227 (header() cannot detect the multi-line header with CR), CRLF
+--FILE--
+<?php
+header("X-foo: e\r\n foo");
+header("X-foo: e\r\nfoo");
+echo 'foo';
+?>
+--EXPECTF--
+Warning: Header may not contain more than a single header, new line detected 
in %s on line %d
+foo
+--EXPECTHEADERS--
+X-foo: e
+ foo

Modified: php/php-src/trunk/main/SAPI.c
===================================================================
--- php/php-src/trunk/main/SAPI.c       2012-02-03 11:35:15 UTC (rev 323042)
+++ php/php-src/trunk/main/SAPI.c       2012-02-03 13:56:37 UTC (rev 323043)
@@ -710,17 +710,26 @@
                efree(header_line);
                return SUCCESS;
        } else {
-               /* new line safety check */
-               char *s = header_line;
-               while (s = strpbrk(s, "\n\r")) {
-                       if (s[1] == ' ' || s[1] == '\t') {
-                               /* RFC 2616 allows new lines if followed by SP 
or HT */
-                               s++;
-                               continue;
+               /* new line/NUL character safety check */
+               int i;
+               for (i = 0; i < header_line_len; i++) {
+                       /* RFC 2616 allows new lines if followed by SP or HT */
+                       int illegal_break =
+                                       (header_line[i+1] != ' ' && 
header_line[i+1] != '\t')
+                                       && (
+                                               header_line[i] == '\n'
+                                               || (header_line[i] == '\r' && 
header_line[i+1] != '\n'));
+                       if (illegal_break) {
+                               efree(header_line);
+                               sapi_module.sapi_error(E_WARNING, "Header may 
not contain "
+                                               "more than a single header, new 
line detected");
+                               return FAILURE;
                        }
-                       efree(header_line);
-                       sapi_module.sapi_error(E_WARNING, "Header may not 
contain more than a single header, new line detected.");
-                       return FAILURE;
+                       if (header_line[i] == '\0') {
+                               efree(header_line);
+                               sapi_module.sapi_error(E_WARNING, "Header may 
not contain NUL bytes");
+                               return FAILURE;
+                       }
                }
        }


-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to