|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2021-11-21 05:51 UTC] ive_jihwan at kaist dot ac dot kr
Description: ------------ There is a special feature in header() function that updates both HTTP status line and response code when the input is starts with "HTTP/" (case insensitive), header() function tries to parse the new HTTP status code from input string by calling atoi() from the first non-whitespace substring after string "HTTP/". And updates the response code as atoi()'s result, and copies the HTTP status line to the raw response without any validation. https://github.com/php/php-src/blob/master/main/SAPI.c#L550 This can cause following two problems. 1. Very wrong format of HTTP status line (which can cause variant problems in browsers) 2. Mismatch of the SAPI response code and HTTP status line due to the overflow of atoi Test script: --------------- <?php header("HTTP/1.1 4294967496 aaa"); Expected result: ---------------- header() should be failed Actual result: -------------- (built-in PHP server) [Sun Nov 21 05:39:04 2021] 127.0.0.1:43808 [200]: GET /sc [Sun Nov 21 05:39:04 2021] 127.0.0.1:43808 Closing (Raw HTTP response message) HTTP/1.1 4294967496 aaa Date: Sun, 21 Nov 2021 05:39:04 GMT Connection: close X-Powered-By: PHP/8.0.13 Content-type: text/html; charset=UTF-8 (curl) $ curl localhost:1234/sc.php curl: (1) Unsupported HTTP version in response (Chrome) https://imgur.com/a/DQT8qqZ (Firefox) https://imgur.com/naIbwVV (Safari) https://imgur.com/gtADjss PatchespHqghUme (last revision 2023-02-08 00:03 UTC by sample at email dot tst)Pull Requests
Pull requests:
HistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Wed Apr 24 03:01:29 2024 UTC |
There was a mistake in writing a report, During all of report, HTTP version must be missing. Thus, Test script should be changed to <?php header("HTTP/ 4294967496 aaa"); and actual result from raw response message also must be changed to HTTP/ 4294967496 aaa Date: Sun, 21 Nov 2021 05:39:04 GMT Connection: close X-Powered-By: PHP/8.0.13 Content-type: text/html; charset=UTF-8