From: Rui Hirokawa <hirokawa@php.net>
Date: Thu, 10 Nov 2011 14:24:31 +0000 (+0000)
Subject: MFH: fixed bug #60227 (header() cannot detect the multi-line header with CR(0x0D).)
X-Git-Tag: php-5.4.0RC2~107
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=cc74264764df336fbc1e5520eb4e5e6f74ccc8d9;p=php

MFH: fixed bug #60227 (header() cannot detect the multi-line header with CR(0x0D).)
---

diff --git a/NEWS b/NEWS
index 2cb7a5659a..26e69c60e8 100644
--- a/NEWS
+++ b/NEWS
@@ -27,6 +27,8 @@ PHP                                                                        NEWS
     is_a and is_subclass_of). (alan_k) 
   . Fixed bug #60116 (escapeshellcmd() cannot escape the characters 
      which cause shell command injection). (rui)
+  . Fixed bug #60227 (header() cannot detect the multi-line header with 
+     CR(0x0D)). (rui)
  
 - Oracle Database extension (OCI8):
   . Increased maxium Oracle error message buffer length for new 11.2.0.3 size 
diff --git a/ext/standard/tests/general_functions/bug60227.phpt b/ext/standard/tests/general_functions/bug60227.phpt
new file mode 100644
index 0000000000..f95a061d2c
--- /dev/null
+++ b/ext/standard/tests/general_functions/bug60227.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #60227 (header() cannot detect the multi-line header with CR)
+--FILE--
+<?php
+header("X-Foo1: a");
+header("X-Foo2: b\n ");
+header("X-Foo3: c\r\n ");
+header("X-Foo4: d\r ");
+header("X-Foo5: e\rSet-Cookie: ID=123");
+echo 'foo';
+?>
+--EXPECTF--
+Warning: Header may not contain more than a single header, new line detected. in %s on line %d
+foo
+--EXPECTHEADERS--
+X-Foo1: a
+X-Foo2: b
+X-Foo3: c
+X-Foo4: d
+
diff --git a/main/SAPI.c b/main/SAPI.c
index 577247012b..f112712b66 100644
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -712,7 +712,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 	} else {
 		/* new line safety check */
 		char *s = header_line, *e = header_line + header_line_len, *p;
-		while (s < e && (p = memchr(s, '\n', (e - s)))) {
+		while (s < e && ((p = memchr(s, '\n', (e - s))) || (p = memchr(s, '\r', (e - s))))) {
 			if (*(p + 1) == ' ' || *(p + 1) == '\t') {
 				s = p + 1;
 				continue;