The new line/NUL check uses a uint32_t index to scan a header whose length
is size_t. For header lines of 4 GiB or more, the index wraps around and
the request never finishes. This also affects session_start() when a
cookie path, domain or session ID produces a header of that size.
Use size_t for the index so it can reach the full header length. Add a
resource-heavy regression test using header() directly, with a newline
after 4 GiB to verify that header validation completes and emits the
usual warning. The test requires a 64-bit platform and runs only when
RUN_RESOURCE_HEAVY_TESTS is enabled and SKIP_SLOW_TESTS is unset.
Closes#24540
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Jakub Zelenka <bukka@php.net>
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
* sapi: Remove sapi_force_http_10
This was introduced in 2b95b3c83b.
This is not used anywhere and the value is dubious.
* sapi: Remove sapi_get_fd
This was introduced in 09f463ddae.
This is not used anywhere.
* sapi: Remove sapi_get_target_[ug]id
These were introduced in 294e776d95.
These are not used anywhere.
This is unused; this is a vestige of 6c158374ba
and 45e327a672, which set up some timeout code
which was removed in 650c1c0a7d. Remove this
useless function from SAPIs.
Correct typographical and grammatical mistakes across docs, comments, and build tools. Refactor local identifiers childrens to children in RecursiveFilterIterator and sav to saved_char in sapi_header_add_op.
sapi_deactivate_module() releases both without resetting the pointer,
unlike the auth_user, auth_password and auth_digest fields next to them.
Nothing reads them between the release and the next sapi_activate()
today, so this is consistency rather than a live bug.
Closes GH-22974
* Fix regression with header removing removing whole prefixes
The header removal code looked for the colon for key-value at the wrong
place, so it would overzealously remove headers. Tweak that condition,
and make the alternative condition only active if it's set (with the
remove prefix op case).
Fixes GH-21018.
* avoid reading past the actual length
* Rename variable to be more clear
* Add SAPI_HEADER_DELETE_PREFIX operation
The session ext currently munges into the linked list of headers
itself, because the delete header API is given the key for headers to
delete. The session ext wants to use a prefix past the colon separator,
for i.e. "Set-Cookie: PHPSESSID=", to eliminate only the specific cookie
rather than all cookies.
This changes the SAPI code to add a new header op to take a prefix
instead. Call sites are yet unchanged. Also fix some whitespace.
* Simplify cookie setting code in ext/session
Use the modern SAPI header ops API, including the remove prefix op we
just added.
* [ci skip] Remove redundant and unnecessary comment
The purpose of this is clear, and after refactoring, the special case is
no longer there, so it has no value.
* Un-deprecate simple add/replace header API, use it
Suggestion from Jakub.
* Restore the optimization removing session cookies had
I don't think this needs to be special cased with the parameter.
* Move setting header length to caller
Suggestion from Jakub.
* [ci skip] adjust tab count
It may be better to use spaces in here instead.
* Use session_cookie_len rather than calling strlen
These were once used in these files but at this point aren't and are
only causing confusion whether file depends on additional extension.
- locale.h is added in main/SAPI.c for _ENABLE_PER_THREAD_LOCALE
RFC: https://wiki.php.net/rfc/rfc1867-non-post
This function allows populating the $_POST and $_FILES globals for non-post
requests. This avoids manual parsing of RFC1867 requests.
Fixes#55815
Closes GH-11472
While __php_mempcpy is only used by ext/standard/crypt_sha*, the
mempcpy "pattern" is used everywhere.
This commit removes __php_mempcpy, adds zend_mempcpy and transforms
open-coded parts into function calls.
This is a result of checking GH-8800 which assumed potential
memory leaks here. Even though it was not the case in reality,
the function deserves a bit of clarification to prevent similar
attempts in the future.
This change primarily splits SAPI deactivation to module and destroy
parts. The reason is that currently some SAPIs might bail out
on deactivation. One of those SAPI is PHP-FPM that can bail out on
request end if for example the connection is closed by the client
(web sever). The problem is that in such case the resources are not
freed and some values reset. The most visible impact can have not
resetting the PG(headers_sent) which can cause erorrs in the next
request. One such issue is described in #77780 bug which this fixes
and is also cover by a test in this commit. It seems reasonable
to separate deactivation and destroying of the resource which means
that the bail out will not impact it.
In particular, this allows using the hook without server_context.
The apache2handler implementation now checks that server_context
is available itself, as that's the implementation that cares
about it.
We need to avoid storing it in the first place, as we don't
really have a good place to release it later. If headers haven't
been sent yet, send_headers will do this. sapi_deactive happens
too late in the shutdown sequence and will result in leak reports.
1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |
This PR corrects misspellings identified by the check-spelling action.
The misspellings have been reported at jsoref@b6ba3e2#commitcomment-48946465
The action reports that the changes in this PR would make it happy: jsoref@602417c
Closes GH-6822.
We're starting to see a mix between uses of zend_bool and bool.
Replace all usages with the standard bool type everywhere.
Of course, zend_bool is retained as an alias.
Weilin Du