From: Michael Wallner <mike@php.net>
Date: Wed, 2 Nov 2005 14:43:09 +0000 (+0000)
Subject: - sapi_header_op(SAPI_HEADER_(REPLACE|ADD), {NULL, 0, 0}) caused HTTP response splitting
X-Git-Tag: php-4.4.2RC1~43
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ff0b18fcf9cc6e1a95eaa126b924f299623f22ca;p=php

- sapi_header_op(SAPI_HEADER_(REPLACE|ADD), {NULL, 0, 0}) caused HTTP response splitting
- sapi_send_headers() already takes care of default_content_type (left over of fix for bug #29983)
---

diff --git a/main/SAPI.c b/main/SAPI.c
index 8d9f4a23fb..451bb217f9 100644
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -525,6 +525,10 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 	case SAPI_HEADER_REPLACE:
 	case SAPI_HEADER_ADD: {
 		sapi_header_line *p = arg;
+		
+		if (!p->line || !p->line_len) {
+			return FAILURE;
+		}
 		header_line = p->line;
 		header_line_len = p->line_len;
 		http_response_code = p->response_code;
diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
index 393b560150..c92c1da38a 100644
--- a/sapi/cgi/cgi_main.c
+++ b/sapi/cgi/cgi_main.c
@@ -335,20 +335,12 @@ static int sapi_cgi_send_headers(sapi_headers_struct *sapi_headers TSRMLS_DC)
 		PHPWRITE_H(buf, len);
 	}
 
-	if (SG(sapi_headers).send_default_content_type) {
-		char *hd;
-
-		hd = sapi_get_default_content_type(TSRMLS_C);
-		PHPWRITE_H("Content-type: ", sizeof("Content-type: ")-1);
-		PHPWRITE_H(hd, strlen(hd));
-		PHPWRITE_H("\r\n", 2);
-		efree(hd);
-	}
-	
 	h = zend_llist_get_first_ex(&sapi_headers->headers, &pos);
-    while (h) {
-		PHPWRITE_H(h->header, h->header_len);
-		PHPWRITE_H("\r\n", 2);
+	while (h) {
+		if (h->header_len) {
+			PHPWRITE_H(h->header, h->header_len);
+			PHPWRITE_H("\r\n", 2);
+		}
 		h = zend_llist_get_next_ex(&sapi_headers->headers, &pos);
 	}
 	PHPWRITE_H("\r\n", 2);