diff options
| author | Rui Hirokawa <hirokawa@php.net> | 2012-01-14 07:41:01 +0000 |
|---|---|---|
| committer | Rui Hirokawa <hirokawa@php.net> | 2012-01-14 07:41:01 +0000 |
| commit | 61088ce7296f2a3b4b53e60bdf413455b870664d (patch) | |
| tree | d1bd1ef7711aff8e849d397823df61294e0410a1 | |
| parent | f115235a6e9db4a91456a5e5475e858de7c06ef8 (diff) | |
| download | php-git-61088ce7296f2a3b4b53e60bdf413455b870664d.tar.gz | |
MFH: fixed bug #60227: header() cannot detect the multi-line header with CR.
| -rw-r--r-- | NEWS | 5 | ||||
| -rw-r--r-- | ext/standard/tests/general_functions/bug60227.phpt | 20 | ||||
| -rw-r--r-- | main/SAPI.c | 2 |
3 files changed, 26 insertions, 1 deletions
@@ -1,5 +1,10 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| +?? ?? 2012, PHP 5.3.10 + +- Core: + . fixed bug #60227: header() cannot detect the multi-line header with CR (rui). + 10 Jan 2012, PHP 5.3.9 - Core: diff --git a/ext/standard/tests/general_functions/bug60227.phpt b/ext/standard/tests/general_functions/bug60227.phpt new file mode 100644 index 0000000000..f95a061d2c --- /dev/null +++ b/ext/standard/tests/general_functions/bug60227.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #60227 (header() cannot detect the multi-line header with CR) +--FILE-- +<?php +header("X-Foo1: a"); +header("X-Foo2: b\n "); +header("X-Foo3: c\r\n "); +header("X-Foo4: d\r "); +header("X-Foo5: e\rSet-Cookie: ID=123"); +echo 'foo'; +?> +--EXPECTF-- +Warning: Header may not contain more than a single header, new line detected. in %s on line %d +foo +--EXPECTHEADERS-- +X-Foo1: a +X-Foo2: b +X-Foo3: c +X-Foo4: d + diff --git a/main/SAPI.c b/main/SAPI.c index 92e3d0874d..154ab6bf29 100644 --- a/main/SAPI.c +++ b/main/SAPI.c @@ -592,7 +592,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC) } else { /* new line safety check */ char *s = header_line, *e = header_line + header_line_len, *p; - while (s < e && (p = memchr(s, '\n', (e - s)))) { + while (s < e && ((p = memchr(s, '\n', (e - s))) || (p = memchr(s, '\r', (e - s))))) { if (*(p + 1) == ' ' || *(p + 1) == '\t') { s = p + 1; continue; |