X-Git-Url: https://git.m6w6.name/?p=m6w6%2Fext-http;a=blobdiff_plain;f=php_http_header_parser.c;h=46551e21248959c67a7aa7d915885a6ec9d1e050;hp=fdbac18698572bee89d2c316d2405a833b04363b;hb=2a02542e7597d7ecf7e6dbb627ae25f7b35a9dfc;hpb=21f7beb95f0a71f3bc62a91b7802ebdebcc549a0

diff --git a/php_http_header_parser.c b/php_http_header_parser.c
index fdbac18..46551e2 100644
--- a/php_http_header_parser.c
+++ b/php_http_header_parser.c
@@ -104,10 +104,10 @@ static void php_http_header_parser_error(size_t valid_len, char *str, size_t len
 
 	escaped_str = php_addcslashes(str, len, &escaped_len, 0, ZEND_STRL("\x0..\x1F\x7F..\xFF") TSRMLS_CC);
 
-	if (valid_len != len) {
+	if (valid_len != len && (!eol_str || (str+valid_len) != eol_str)) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Failed to parse headers: unexpected character '\\%03o' at pos %zu of '%.*s'", str[valid_len], valid_len, escaped_len, escaped_str);
 	} else if (eol_str) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Failed to parse headers: unexpected character '\\%03o' at pos %zu of '%.*s'", *eol_str, eol_str - str, escaped_len, escaped_str);
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Failed to parse headers: unexpected end of line at pos %zu of '%.*s'", eol_str - str, escaped_len, escaped_str);
 	} else {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Failed to parse headers: unexpected end of input at pos %zu of '%.*s'", len, escaped_len, escaped_str);
 	}
@@ -115,7 +115,7 @@ static void php_http_header_parser_error(size_t valid_len, char *str, size_t len
 	efree(escaped_str);
 }
 
-STATUS php_http_header_parser_parse(php_http_header_parser_t *parser, php_http_buffer_t *buffer, unsigned flags, HashTable *headers, php_http_info_callback_t callback_func, void *callback_arg)
+php_http_header_parser_state_t php_http_header_parser_parse(php_http_header_parser_t *parser, php_http_buffer_t *buffer, unsigned flags, HashTable *headers, php_http_info_callback_t callback_func, void *callback_arg)
 {
 	TSRMLS_FETCH_FROM_CTX(parser->ts);
 
@@ -146,11 +146,14 @@ STATUS php_http_header_parser_parse(php_http_header_parser_t *parser, php_http_b
 				const char *colon, *eol_str = NULL;
 				int eol_len = 0;
 
+				/* fix buffer here, so eol_str pointer doesn't become obsolete afterwards */
+				php_http_buffer_fix(buffer);
+
 				if (buffer->data == (eol_str = php_http_locate_bin_eol(buffer->data, buffer->used, &eol_len))) {
 					/* end of headers */
 					php_http_buffer_cut(buffer, 0, eol_len);
 					php_http_header_parser_state_push(parser, 1, PHP_HTTP_HEADER_PARSER_STATE_DONE);
-				} else if (php_http_info_parse(&parser->info, php_http_buffer_fix(buffer)->data TSRMLS_CC)) {
+				} else if (php_http_info_parse(&parser->info, buffer->data TSRMLS_CC)) {
 					/* new message starting with request/response line */
 					if (callback_func) {
 						callback_func(callback_arg, &headers, &parser->info TSRMLS_CC);
@@ -176,7 +179,6 @@ STATUS php_http_header_parser_parse(php_http_header_parser_t *parser, php_http_b
 					php_http_header_parser_state_push(parser, 1, PHP_HTTP_HEADER_PARSER_STATE_VALUE);
 				} else if (eol_str || (flags & PHP_HTTP_HEADER_PARSER_CLEANUP)) {
 					/* neither reqeust/response line nor 'header:' string, or injected new line or NUL etc. */
-					php_http_buffer_fix(buffer);
 					php_http_header_parser_error(strspn(buffer->data, PHP_HTTP_HEADER_NAME_CHARS), buffer->data, buffer->used, eol_str TSRMLS_CC);
 					return php_http_header_parser_state_push(parser, 1, PHP_HTTP_HEADER_PARSER_STATE_FAILURE);
 				} else {
@@ -246,6 +248,17 @@ STATUS php_http_header_parser_parse(php_http_header_parser_t *parser, php_http_b
 			case PHP_HTTP_HEADER_PARSER_STATE_HEADER_DONE:
 				if (parser->_key.str && parser->_val.str) {
 					zval array, **exist;
+					size_t valid_len = strlen(parser->_val.str);
+
+					/* check for truncation */
+					if (valid_len != parser->_val.len) {
+						php_http_header_parser_error(valid_len, parser->_val.str, parser->_val.len, NULL TSRMLS_CC);
+
+						PTR_SET(parser->_key.str, NULL);
+						PTR_SET(parser->_val.str, NULL);
+
+						return php_http_header_parser_state_push(parser, 1, PHP_HTTP_HEADER_PARSER_STATE_FAILURE);
+					}
 
 					if (!headers && callback_func) {
 						callback_func(callback_arg, &headers, NULL TSRMLS_CC);
@@ -278,7 +291,7 @@ STATUS php_http_header_parser_parse(php_http_header_parser_t *parser, php_http_b
 
 php_http_header_parser_state_t php_http_header_parser_parse_stream(php_http_header_parser_t *parser, php_http_buffer_t *buf, php_stream *s, unsigned flags, HashTable *headers, php_http_info_callback_t callback_func, void *callback_arg)
 {
-	php_http_message_parser_state_t state = PHP_HTTP_MESSAGE_PARSER_STATE_START;
+	php_http_header_parser_state_t state = PHP_HTTP_HEADER_PARSER_STATE_START;
 	TSRMLS_FETCH_FROM_CTX(parser->ts);
 
 	if (!buf->data) {