Repository navigation
Conversation
… header location_len == 0 was used to mean that no buffer was allocated yet, but an empty Location header allocates a 1-byte buffer and leaves location_len at 0. A second Location header then allocated a new buffer and leaked the first. Check the pointer instead.
ndossche
approved these changes
Oct 23, 2026
ndossche
left a comment
ndossche
left a comment
Member
There was a problem hiding this comment.
I think this is right, thanks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes GH-24509
php_stream_http_response_headers_parse()usedlocation_len == 0to mean "no Location buffer allocated yet". An emptyLocation:header allocates a 1-byte buffer and leaveslocation_lenat 0, so a laterLocation:header took theemalloc()branch again and leaked the first buffer. It now checksheader_info->location == NULL. The struct is zeroed byphp_stream_http_response_header_info_init(), and the pointer is set back to NULL wherever the buffer is handed off or freed.The new
ext/standard/tests/http/gh24509.phptsendsLocation:followed byLocation: /abcdefghijklmno, then follows the redirect. On a debug build (--enable-debug --enable-pcntl --enable-posix) of PHP-8.4 without the fix it fails with:With the fix it passes, and
ext/standard/tests/http/gives 71 passed, 14 skipped, 0 failed.I targeted PHP-8.4 because the same code is there.