php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #48929
Submitted: 2009-07-15 17:26 UTC Modified: 2009-07-20 10:55 UTC
From: david dot zuelke at bitextender dot com Assigned:
Status: Closed Package: Streams related
PHP Version: 5.*, 6 OS: *
Private report: No CVE-ID:
 [2009-07-15 17:26 UTC] david dot zuelke at bitextender dot com
Description:
------------
When making an HTTP request through the HTTP stream wrapper, there will 
be a duplicate \r\n sequence separating header lines and request body if 
the HTTP stream context option "header" is an array (which is possible 
since 5.2.10; it had to be a string with the individual, \r\n-separated 
header lines before that).

As a result, the last two bytes of the request will never reach the 
destination server, as it closes the connection when reaching the 
indicated Content-Length (which is off by two bytes due to the extra 
\r\n). The HTTP specification explicitly states that one \r\n sequence 
should be used to separate the last (\r\n-terminated) header line from 
the request body.

All is fine when supplying headers as a string instead of an array.

Reproduce code:
---------------
$context = stream_context_create(array('http' => array('header' => array('X-Foo: bar', 'Content-Type: text/plain'), 'method' => 'POST', 'content' => 'ohai')));
$fd = fopen('http://127.0.0.1:12342/', 'rb', false, $context);

Expected result:
----------------
A \r\n after the last header, another \r\n to create a blank line, then 
"ohai"

Actual result:
--------------
A \r\n after the last header, then \r\n twice which creates two blank 
lines, then "oh". "ai" never arrives as the Content-Length is reached.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-07-15 17:48 UTC] david dot zuelke at bitextender dot com
Patch: http://pastie.org/547066
 [2009-07-15 17:53 UTC] david dot zuelke at bitextender dot com
http://article.gmane.org/gmane.comp.php.devel/57937
 [2009-07-20 10:54 UTC] svn@php.net
Automatic comment from SVN on behalf of jani
Revision: http://svn.php.net/viewvc/?view=revision&revision=284428
Log: Fixed bug #48929 (Double \r\n after HTTP headers when "header" context option is an array)
 [2009-07-20 10:55 UTC] jani@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Fri Apr 25 07:02:14 2014 UTC