From 604de67b7d0b8c6db76002011e3b55dd9c7aeec8 Mon Sep 17 00:00:00 2001
From: Adam Harvey <aharvey@php.net>
Date: Mon, 7 Jul 2014 20:36:06 +0000
Subject: [PATCH] Fixed bug #66830 (Empty header causes PHP built-in web server
 to hang).

We had an infinite loop in sapi_cli_server_send_headers(): while iterating over
the linked list of headers, when an empty header was hit, continue would go to
the next iteration of the loop without updating h to be the next value in the
linked list. Updating it to always increment regardless of whether the header
is actually valid or not fixes the issue.
---
 NEWS                         |  2 ++
 sapi/cli/php_cli_server.c    |  7 +++---
 sapi/cli/tests/bug66830.phpt | 43 ++++++++++++++++++++++++++++++++++++
 3 files changed, 48 insertions(+), 4 deletions(-)
 create mode 100644 sapi/cli/tests/bug66830.phpt

diff --git a/NEWS b/NEWS
index ee9bb13e30..53d4f668cd 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,8 @@ PHP                                                                        NEWS
 - CLI server:
   . Implemented FR #67429 (CLI server is missing some new HTTP response codes).
     (Adam)
+  . Fixed bug #66830 (Empty header causes PHP built-in web server to hang).
+    (Adam)
 
 - FPM:
   . Fixed bug #67531 (syslog cannot be set in pool configuration). (Remi)
diff --git a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c
index 2425cc0c3e..375aa25c42 100644
--- a/sapi/cli/php_cli_server.c
+++ b/sapi/cli/php_cli_server.c
@@ -540,11 +540,10 @@ static int sapi_cli_server_send_headers(sapi_headers_struct *sapi_headers TSRMLS
 
 	h = (sapi_header_struct*)zend_llist_get_first_ex(&sapi_headers->headers, &pos);
 	while (h) {
-		if (!h->header_len) {
-			continue;
+		if (h->header_len) {
+			smart_str_appendl(&buffer, h->header, h->header_len);
+			smart_str_appendl(&buffer, "\r\n", 2);
 		}
-		smart_str_appendl(&buffer, h->header, h->header_len);
-		smart_str_appendl(&buffer, "\r\n", 2);
 		h = (sapi_header_struct*)zend_llist_get_next_ex(&sapi_headers->headers, &pos);
 	}
 	smart_str_appendl(&buffer, "\r\n", 2);
diff --git a/sapi/cli/tests/bug66830.phpt b/sapi/cli/tests/bug66830.phpt
new file mode 100644
index 0000000000..68fcf21c11
--- /dev/null
+++ b/sapi/cli/tests/bug66830.phpt
@@ -0,0 +1,43 @@
+--TEST--
+Bug #66830 (Empty header causes PHP built-in web server to hang)
+--SKIPIF--
+<?php
+include "skipif.inc";
+?>
+--FILE--
+<?php
+include "php_cli_server.inc";
+php_cli_server_start(<<<'PHP'
+header(' ');
+PHP
+);
+
+list($host, $port) = explode(':', PHP_CLI_SERVER_ADDRESS);
+$port = intval($port)?:80;
+
+$fp = fsockopen($host, $port, $errno, $errstr, 0.5);
+if (!$fp) {
+  die("connect failed");
+}
+
+if(fwrite($fp, <<<HEADER
+GET / HTTP/1.1
+Host: {$host}
+
+
+HEADER
+)) {
+    while (!feof($fp)) {
+        echo fgets($fp);
+    }
+}
+
+fclose($fp);
+?>
+--EXPECTF--
+HTTP/1.1 200 OK
+Host: %s
+Connection: close
+X-Powered-By: %s
+Content-type: text/html
+
-- 
2.49.0