Fixed bug #34359 (Possible crash inside fopen http wrapper).

diff --git a/NEWS b/NEWS
index a803cab61bcd9831250960d3ef75bd1812075c20..abf086b34f5275287b9ed737e6b9977d778b85d1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -61,6 +61,7 @@ PHP                                                                        NEWS
   (Nuno, Ilia)
 - Fixed bug #35028 (SimpleXML object fails FALSE test). (Marcus)
 - Fixed bug #34729 (Crash in ZTS mode under Apache). (Dmitry, Zeev) 
+- Fixed bug #34359 (Possible crash inside fopen http wrapper). (Ilia,Sara,Nuno)
 - Fixed bug #30760 (Remove MessageBox on win32 for E_CORE errors if 
   display_startup_error is off). (Ilia)
 

diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c
index 4c2321f4868c50f32a7fa32dbcf41965f246d39f..b054c7353c248ba5c931d53613ab9bd3bc397a7f 100644 (file)
--- a/ext/standard/http_fopen_wrapper.c
+++ b/ext/standard/http_fopen_wrapper.c
@@ -526,28 +526,16 @@ php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper, char *path,
        
        http_header_line = emalloc(HTTP_HEADER_BLOCK_SIZE);
 
-       while (!body && !php_stream_eof(stream))        {
-               
-               if (php_stream_gets(stream, http_header_line, HTTP_HEADER_BLOCK_SIZE-1) != NULL)        {
-                       char *p;
-                       int found_eol = 0;
-                       int http_header_line_length;
-                       
-                       http_header_line[HTTP_HEADER_BLOCK_SIZE-1] = '\0';
-
-                       p = http_header_line;
-                       while(*p) {
-                               while(*p == '\n' || *p == '\r') {
-                                       *p = '\0';
-                                       p--;
-                                       found_eol = 1;
-                               }
-                               if (found_eol)
-                                       break;
-                               p++;
+       while (!body && !php_stream_eof(stream)) {
+               size_t http_header_line_length;
+               if (php_stream_get_line(stream, http_header_line, HTTP_HEADER_BLOCK_SIZE, &http_header_line_length TSRMLS_CC) && *http_header_line != '\n' && *http_header_line != '\r') {
+                       char *e = http_header_line + http_header_line_length - 1;
+                       while (*e == '\n' || *e == '\r') {
+                               e--;
                        }
-                       http_header_line_length = p-http_header_line+1;
-               
+                       http_header_line_length = e - http_header_line + 1;
+                       http_header_line[http_header_line_length] = '\0';
+
                        if (!strncasecmp(http_header_line, "Location: ", 10)) {
                                strlcpy(location, http_header_line + 10, sizeof(location));
                        } else if (!strncasecmp(http_header_line, "Content-Type: ", 14)) {