The default is non-strict, we need to keep the default for BC reasons.
We change the macro handling such that it can be enabled now, previously
it couldn't be enabled.
Closes GH-24704.
Co-authored-by: David Carlier <devnexen@gmail.com>
The dev server's HTTP parser accumulates Content-Length digits into an
ssize_t without an overflow check; a 30-digit value wraps and the
consumer aborts on pemalloc. Guard the decimal and chunked-size
accumulators against SSIZE_MAX, then reject in on_headers_complete when
the parsed length exceeds post_max_size and reply 413 with the
configured limit in the body.
A chunked request carries no Content-Length, so enforce the same limit
as the chunks accumulate in on_body, and honour a non-zero return from
that callback in the parser. The body buffer was reserved from the
declared length and resized down to the bytes in hand on the next line,
so a chunk header of 7FFFFFFFFFFFFF aborted the server for no gain; grow
it from the received length instead. A parse error between a header name
and its value left the copied name owned by nobody; release both header
strings in php_cli_server_client_dtor().
Fixes GH-22003
While our HTTP parser supports upgrade requests, the code using it does
not. Since upgrade requests are only valid for HTTP/1.1 and we neither
support any higher version, nor HTTPS yet, we do not exit early in case
of such requests, i.e. we ignore them, what is allowed by the specs.
We keep the supporting code in case we can meaningfully support upgrade
requests in the future.
Closes GH-7316.
* Correctly identify unused speculative preconnections from browsers
like Chrome and Firefox
* Add a new message to the debug level that is emitted when a TCP
connection is closed without sending any request (a preconnection)
* Fix an issue where the existing debug messages were not being
displayed even when debug mode was enabled
A char can be either signed or unsigned, and on PowerPC and ARM it is
unsigned. The following code will always be false on these architectures:
if (c == -1) goto error;
ndossche