Merge branch 'v2.5.x'

diff --git a/.gitattributes b/.gitattributes
index b0aef47cbde05ad2cc0e39899c08abc18ef08d57..715993274e64dc0ea64acddd9c2faa567e2e5a9b 100644 (file)
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,3 +1,4 @@
 package.xml            merge=touch
 php_http.h             merge=touch
 .travis.yml            merge=touch
+/tests/data/bug71719.bin       -diff -text

diff --git a/TODO b/TODO
index 33b759f2d5c26778d012dcb06c727c837ff7116d..468f9c154ddbb0d22c2981166b5d1cdad2b0f65a 100644 (file)
--- a/TODO
+++ b/TODO
@@ -1,3 +1,4 @@
 * let the message body be a simple query string unless files are added
 * php_http_message_serialize reverses the chain twice; remove that
-* CURLOPT_PROXY_HEADER and CURLOPT_HEADEROPT
\ No newline at end of file
+* CURLOPT_PROXY_HEADER and CURLOPT_HEADEROPT
+* CURLMOPT_PIPELINING changed to a bitmask
\ No newline at end of file

diff --git a/src/php_http_client_curl.c b/src/php_http_client_curl.c
index e79ef1519ce5c39ba5a7fefc433db7d1be96b07b..e56f8d416b6a6e1701922f504945d1e09a2bcd41 100644 (file)
--- a/src/php_http_client_curl.c
+++ b/src/php_http_client_curl.c
@@ -1484,7 +1484,7 @@ static void php_http_curle_options_init(php_http_options_t *registry)
                        ZVAL_BOOL(&opt->defval, 1);
                        opt->setter = php_http_curle_option_set_ssl_verifyhost;
                }
-#if PHP_HTTP_CURL_VERSION(7,41,0)
+#if PHP_HTTP_CURL_VERSION(7,41,0) && (defined(PHP_HTTP_HAVE_OPENSSL) || defined(PHP_HTTP_HAVE_NSS) || defined(PHP_HTTP_HAVE_GNUTLS))
                php_http_option_register(registry, ZEND_STRL("verifystatus"), CURLOPT_SSL_VERIFYSTATUS, _IS_BOOL);
 #endif
                php_http_option_register(registry, ZEND_STRL("cipher_list"), CURLOPT_SSL_CIPHER_LIST, IS_STRING);
@@ -2534,6 +2534,9 @@ PHP_MINIT_FUNCTION(http_client_curl)
        REGISTER_NS_LONG_CONSTANT("http\\Client\\Curl", "HTTP_VERSION_1_1", CURL_HTTP_VERSION_1_1, CONST_CS|CONST_PERSISTENT);
 #if PHP_HTTP_CURL_VERSION(7,33,0)
        REGISTER_NS_LONG_CONSTANT("http\\Client\\Curl", "HTTP_VERSION_2_0", CURL_HTTP_VERSION_2_0, CONST_CS|CONST_PERSISTENT);
+#endif
+#if PHP_HTTP_CURL_VERSION(7,47,0)
+       REGISTER_NS_LONG_CONSTANT("http\\Client\\Curl", "HTTP_VERSION_2TLS", CURL_HTTP_VERSION_2TLS, CONST_CS|CONST_PERSISTENT);
 #endif
        REGISTER_NS_LONG_CONSTANT("http\\Client\\Curl", "HTTP_VERSION_ANY", CURL_HTTP_VERSION_NONE, CONST_CS|CONST_PERSISTENT);
 

diff --git a/src/php_http_url.c b/src/php_http_url.c
index 4009add52fc369a78c1741b9c2d12a2466bc1516..3ed2e3cbf2fd6beeee72a41ca50345b957efbdf6 100644 (file)
--- a/src/php_http_url.c
+++ b/src/php_http_url.c
@@ -1468,7 +1468,7 @@ static const char *parse_scheme(struct parse_state *state)
                case '7': case '8': case '9':
                case '+': case '-': case '.':
                        if (state->ptr == tmp) {
-                               return tmp;
+                               goto softfail;
                        }
                        /* no break */
                case 'A': case 'B': case 'C': case 'D': case 'E': case 'F': case 'G':
@@ -1485,19 +1485,20 @@ static const char *parse_scheme(struct parse_state *state)
 
                default:
                        if (!(mb = parse_mb(state, PARSE_SCHEME, state->ptr, state->end, tmp, 1))) {
-                               /* soft fail; parse path next */
-                               return tmp;
+                               goto softfail;
                        }
                        state->ptr += mb - 1;
                }
        } while (++state->ptr != state->end);
 
+softfail:
+       state->offset = 0;
        return state->ptr = tmp;
 }
 
 php_http_url_t *php_http_url_parse(const char *str, size_t len, unsigned flags)
 {
-       size_t maxlen = 3 * len;
+       size_t maxlen = 3 * len + 8 /* null bytes for all components */;
        struct parse_state *state = ecalloc(1, sizeof(*state) + maxlen);
 
        state->end = str + len;

diff --git a/tests/bug71719.phpt b/tests/bug71719.phpt
new file mode 100644 (file)
index 0000000..f75bac9
--- /dev/null
+++ b/tests/bug71719.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Buffer overflow in HTTP url parsing functions
+--SKIPIF--
+<?php
+include "skipif.inc";
+?>
+--FILE--
+<?php
+
+echo "Test\n";
+try {
+       echo new http\Message(file_get_contents(__DIR__."/data/bug71719.bin"), false);
+} catch (Exception $e) {
+       echo $e;
+}
+?>
+
+===DONE===
+--EXPECTF--
+Test
+%r(exception ')?%rhttp\Exception\BadMessageException%r(' with message '|: )%rhttp\Message::__construct(): Could not parse HTTP protocol version 'HTTP/%s.0'%r'?%r in %sbug71719.php:5
+Stack trace:
+#0 %sbug71719.php(5): http\Message->__construct('\x80\xACTd 5 HTTP/1.1...', false)
+#1 {main}
+===DONE===

diff --git a/tests/data/bug71719.bin b/tests/data/bug71719.bin
new file mode 100644 (file)
index 0000000..245db28
Binary files /dev/null and b/tests/data/bug71719.bin differ