- Merging r323033 into 5.3 (see bug #60227).

diff --git a/NEWS b/NEWS
index c16f316d78b27ad5f497d0f4629dd1f5675d0c77..d3feda4734b51dc6b8df84bad81ea370b74da7cf 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -7,7 +7,7 @@ PHP                                                                        NEWS
 
 - Core:
   . Fixed bug #60227 (header() cannot detect the multi-line header with CR).
-    (rui)
+    (rui, Gustavo)
   . Fixed bug #60825 (Segfault when running symfony 2 tests).
     (Dmitry, Laruence)
   . Fix bug #60895 (Possible invalid handler usage in windows random

diff --git a/ext/standard/tests/general_functions/bug60227.phpt b/ext/standard/tests/general_functions/bug60227_1.phpt
similarity index 100%
rename from ext/standard/tests/general_functions/bug60227.phpt
rename to ext/standard/tests/general_functions/bug60227_1.phpt

diff --git a/ext/standard/tests/general_functions/bug60227_2.phpt b/ext/standard/tests/general_functions/bug60227_2.phpt
new file mode 100644 (file)
index 0000000..fd383f3
--- /dev/null
+++ b/ext/standard/tests/general_functions/bug60227_2.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #60227 (header() cannot detect the multi-line header with CR), \r before \n
+--FILE--
+<?php
+header("X-foo: e\n foo");
+header("X-Foo6: e\rSet-Cookie: ID=123\n d");
+echo 'foo';
+?>
+--EXPECTF--
+Warning: Header may not contain more than a single header, new line detected. in %s on line %d
+foo
+--EXPECTHEADERS--
+X-foo: e
+foo

diff --git a/main/SAPI.c b/main/SAPI.c
index 154ab6bf29f2a9c5f0e1347af20ac5180a98cb86..693cad342955b79ae5eff830d49cccef33f08646 100644 (file)
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -591,10 +591,11 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
                }
        } else {
                /* new line safety check */
-               char *s = header_line, *e = header_line + header_line_len, *p;
-               while (s < e && ((p = memchr(s, '\n', (e - s))) || (p = memchr(s, '\r', (e - s))))) {
-                       if (*(p + 1) == ' ' || *(p + 1) == '\t') {
-                               s = p + 1;
+               char *s = header_line;
+               while (s = strpbrk(s, "\n\r")) {
+                       if (s[1] == ' ' || s[1] == '\t') {
+                               /* RFC 2616 allows new lines if followed by SP or HT */
+                               s++;
                                continue;
                        }
                        efree(header_line);