mirror of
https://github.com/php/php-src.git
synced 2026-10-28 17:56:50 +08:00
David Carlier
f6fe838e36
Commit 3dcdb9826b routed the user_agent option through a truncate-and-warn
check, but the Content-Type context option, the soapaction and the cookie
names and values reach the same request buffer unchecked, so a CR/LF in any
of them still injects arbitrary request headers.
Emit all of them through that same check. The helper now takes an explicit
length so the char* soapaction can share it.
Close GH-22781