summaryrefslogtreecommitdiff
path: root/main/SAPI.c
diff options
context:
space:
mode:
authorIlia Alshanetsky <iliaa@php.net>2005-12-06 03:39:45 +0000
committerIlia Alshanetsky <iliaa@php.net>2005-12-06 03:39:45 +0000
commitf2415625d4848b503f1fbcc7986211d6eb4aa7df (patch)
tree3ec941fdce00e854ae62edf40848e134626bc7c6 /main/SAPI.c
parentaa1b0709f211f1e986c911df1bda29f25b652efa (diff)
downloadphp-git-f2415625d4848b503f1fbcc7986211d6eb4aa7df.tar.gz
MFH: Prevent header injection by limiting each header to a single line.
Diffstat (limited to 'main/SAPI.c')
-rw-r--r--main/SAPI.c13
1 files changed, 13 insertions, 0 deletions
diff --git a/main/SAPI.c b/main/SAPI.c
index 981fae805f..6c3733ae55 100644
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -566,6 +566,19 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
while(isspace(header_line[header_line_len-1]))
header_line[--header_line_len]='\0';
+ /* new line safety check */
+ {
+ char *s = header_line, *e = header_line + header_line_len, *p;
+ while (s < e && (p = memchr(s, '\n', (e - s)))) {
+ if (*(p + 1) == ' ' || *(p + 1) == '\t') {
+ s = p + 1;
+ continue;
+ }
+ efree(header_line);
+ sapi_module.sapi_error(E_WARNING, "Header may not contain more then a single header, new line detected.");
+ return FAILURE;
+ }
+ }
sapi_header.header = header_line;
sapi_header.header_len = header_line_len;