From 4cc747677c99c8962efe2af6639a2099da63f5f1 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Wed, 7 Mar 2012 07:49:56 +0000
Subject: [PATCH] MFH: Headers: forbid \r and \n also after \0, allow CRLF
 followed by HT or SP and forbid \0. See bug #60227.

---
 .../{bug60227.phpt => bug60227_1.phpt}        |  2 +-
 .../tests/general_functions/bug60227_2.phpt   | 14 ++++++++++
 .../tests/general_functions/bug60227_3.phpt   | 14 ++++++++++
 .../tests/general_functions/bug60227_4.phpt   | 14 ++++++++++
 main/SAPI.c                                   | 28 +++++++++++++------
 5 files changed, 62 insertions(+), 10 deletions(-)
 rename ext/standard/tests/general_functions/{bug60227.phpt => bug60227_1.phpt} (92%)
 create mode 100644 ext/standard/tests/general_functions/bug60227_2.phpt
 create mode 100644 ext/standard/tests/general_functions/bug60227_3.phpt
 create mode 100644 ext/standard/tests/general_functions/bug60227_4.phpt

diff --git a/ext/standard/tests/general_functions/bug60227.phpt b/ext/standard/tests/general_functions/bug60227_1.phpt
similarity index 92%
rename from ext/standard/tests/general_functions/bug60227.phpt
rename to ext/standard/tests/general_functions/bug60227_1.phpt
index f95a061d2c..8efe222ada 100644
--- a/ext/standard/tests/general_functions/bug60227.phpt
+++ b/ext/standard/tests/general_functions/bug60227_1.phpt
@@ -10,7 +10,7 @@ header("X-Foo5: e\rSet-Cookie: ID=123");
 echo 'foo';
 ?>
 --EXPECTF--
-Warning: Header may not contain more than a single header, new line detected. in %s on line %d
+Warning: Header may not contain more than a single header, new line detected in %s on line %d
 foo
 --EXPECTHEADERS--
 X-Foo1: a
diff --git a/ext/standard/tests/general_functions/bug60227_2.phpt b/ext/standard/tests/general_functions/bug60227_2.phpt
new file mode 100644
index 0000000000..995c364eea
--- /dev/null
+++ b/ext/standard/tests/general_functions/bug60227_2.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #60227 (header() cannot detect the multi-line header with CR), \r before \n
+--FILE--
+<?php
+header("X-foo: e\n foo");
+header("X-Foo6: e\rSet-Cookie: ID=123\n d");
+echo 'foo';
+?>
+--EXPECTF--
+Warning: Header may not contain more than a single header, new line detected in %s on line %d
+foo
+--EXPECTHEADERS--
+X-foo: e
+foo
diff --git a/ext/standard/tests/general_functions/bug60227_3.phpt b/ext/standard/tests/general_functions/bug60227_3.phpt
new file mode 100644
index 0000000000..8cba9b8aec
--- /dev/null
+++ b/ext/standard/tests/general_functions/bug60227_3.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #60227 (header() cannot detect the multi-line header with CR), \0 before \n
+--FILE--
+<?php
+header("X-foo: e\n foo");
+header("X-Foo6: e\0Set-Cookie: ID=\n123\n d");
+echo 'foo';
+?>
+--EXPECTF--
+Warning: Header may not contain NUL bytes in %s on line %d
+foo
+--EXPECTHEADERS--
+X-foo: e
+foo
diff --git a/ext/standard/tests/general_functions/bug60227_4.phpt b/ext/standard/tests/general_functions/bug60227_4.phpt
new file mode 100644
index 0000000000..d5e2573d89
--- /dev/null
+++ b/ext/standard/tests/general_functions/bug60227_4.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #60227 (header() cannot detect the multi-line header with CR), CRLF
+--FILE--
+<?php
+header("X-foo: e\r\n foo");
+header("X-foo: e\r\nfoo");
+echo 'foo';
+?>
+--EXPECTF--
+Warning: Header may not contain more than a single header, new line detected in %s on line %d
+foo
+--EXPECTHEADERS--
+X-foo: e
+ foo
diff --git a/main/SAPI.c b/main/SAPI.c
index 0fbf5257c1..74fdbb2c4a 100644
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -707,16 +707,26 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 		efree(header_line);
 		return SUCCESS;
 	} else {
-		/* new line safety check */
-		char *s = header_line, *e = header_line + header_line_len, *p;
-		while (s < e && ((p = memchr(s, '\n', (e - s))) || (p = memchr(s, '\r', (e - s))))) {
-			if (*(p + 1) == ' ' || *(p + 1) == '\t') {
-				s = p + 1;
-				continue;
+		/* new line/NUL character safety check */
+		int i;
+		for (i = 0; i < header_line_len; i++) {
+			/* RFC 2616 allows new lines if followed by SP or HT */
+			int illegal_break =
+					(header_line[i+1] != ' ' && header_line[i+1] != '\t')
+					&& (
+						header_line[i] == '\n'
+						|| (header_line[i] == '\r' && header_line[i+1] != '\n'));
+			if (illegal_break) {
+				efree(header_line);
+				sapi_module.sapi_error(E_WARNING, "Header may not contain "
+						"more than a single header, new line detected");
+				return FAILURE;
+			}
+			if (header_line[i] == '\0') {
+				efree(header_line);
+				sapi_module.sapi_error(E_WARNING, "Header may not contain NUL bytes");
+				return FAILURE;
 			}
-			efree(header_line);
-			sapi_module.sapi_error(E_WARNING, "Header may not contain more than a single header, new line detected.");
-			return FAILURE;
 		}
 	}
 
-- 
2.50.1