sapi/cli: guard Content-Length overflow and enforce post_max_size #22017
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| --TEST-- | ||
| GH-22003 (CLI server: overflow in Content-Length parser + post_max_size enforcement) | ||
| --SKIPIF-- | ||
| <?php | ||
| include "skipif.inc"; | ||
| ?> | ||
| --FILE-- | ||
| <?php | ||
| include "php_cli_server.inc"; | ||
| php_cli_server_start("echo 'OK';", null, ['-d', 'post_max_size=1024']); | ||
|
|
||
| $host = PHP_CLI_SERVER_HOSTNAME; | ||
|
|
||
| // 1. Content-Length above the configured post_max_size but within ssize_t: | ||
| // consumer must reject with a 413 page before allocating a body buffer. | ||
| $fp = php_cli_server_connect(); | ||
| fwrite($fp, "POST / HTTP/1.1\r\nHost: $host\r\nContent-Length: 999999\r\nConnection: close\r\n\r\n"); | ||
| $response = stream_get_contents($fp); | ||
| fclose($fp); | ||
| echo "over post_max_size: ", str_contains($response, "413 Request Entity Too Large") ? "413" : "FAIL", "\n"; | ||
| echo "shows configured limit: ", str_contains($response, "1024 bytes") ? "yes" : "no", "\n"; | ||
|
|
||
| // 2. Same case but with body bytes piggybacked in the same write. The parser sees | ||
| // the body bytes after on_headers_complete bails; without a guard in the | ||
| // read-request error path the response would be 400 instead of 413. | ||
| $fp = php_cli_server_connect(); | ||
| fwrite($fp, "POST / HTTP/1.1\r\nHost: $host\r\nContent-Length: 999999\r\nConnection: close\r\n\r\n0123456789"); | ||
| $response = stream_get_contents($fp); | ||
| fclose($fp); | ||
| echo "over limit with body bytes: ", str_contains($response, "413 Request Entity Too Large") ? "413" : "FAIL", "\n"; | ||
|
|
||
| // 3. Content-Length wide enough to overflow ssize_t accumulation in the parser: | ||
| // parser-level guard rejects as a malformed request before headers-complete fires. | ||
| $fp = php_cli_server_connect(); | ||
| fwrite($fp, "POST / HTTP/1.1\r\nHost: $host\r\nContent-Length: 999999999999999999999999999999\r\nConnection: close\r\n\r\n"); | ||
| $response = stream_get_contents($fp); | ||
| fclose($fp); | ||
| echo "content-length overflow: ", str_contains($response, "200 OK") ? "FAIL" : "rejected", "\n"; | ||
|
|
||
| // 4. Transfer-Encoding: chunked with an oversized hex chunk size: same parser guard | ||
| // on the chunked accumulator must reject without aborting the server. | ||
| $fp = php_cli_server_connect(); | ||
| fwrite($fp, "POST / HTTP/1.1\r\nHost: $host\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n" | ||
| . str_repeat("F", 32) . "\r\n"); | ||
| $response = stream_get_contents($fp); | ||
| fclose($fp); | ||
| echo "chunked overflow: ", str_contains($response, "200 OK") ? "FAIL" : "rejected", "\n"; | ||
|
|
||
| // 5. Chunked body whose accumulated size exceeds post_max_size. No Content-Length | ||
| // header exists, so the limit can only be enforced as the chunks arrive. | ||
| $fp = php_cli_server_connect(); | ||
| $request = "POST / HTTP/1.1\r\nHost: $host\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n"; | ||
| for ($i = 0; $i < 4; $i++) { | ||
| $request .= sprintf("%x\r\n%s\r\n", 1000, str_repeat("A", 1000)); | ||
| } | ||
| fwrite($fp, $request . "0\r\n\r\n"); | ||
| $response = stream_get_contents($fp); | ||
| fclose($fp); | ||
| echo "chunked over post_max_size: ", str_contains($response, "413 Request Entity Too Large") ? "413" : "FAIL", "\n"; | ||
|
|
||
| // 6. Chunk size under the ssize_t guard but far above post_max_size, with only a few | ||
| // body bytes behind it: the buffer must grow with the bytes that arrive, never | ||
| // from the declared chunk size. | ||
| $fp = php_cli_server_connect(); | ||
| fwrite($fp, "POST / HTTP/1.1\r\nHost: $host\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n" | ||
| . "7FFFFFFFFFFFFF\r\nHELLO"); | ||
| stream_socket_shutdown($fp, STREAM_SHUT_WR); | ||
| $response = stream_get_contents($fp); | ||
| fclose($fp); | ||
| echo "oversize chunk size: ", str_contains($response, "200 OK") ? "FAIL" : "rejected", "\n"; | ||
|
|
||
| // 7. A chunked body within the limit still reaches the script. | ||
| $fp = php_cli_server_connect(); | ||
| fwrite($fp, "POST / HTTP/1.1\r\nHost: $host\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n" | ||
| . sprintf("%x\r\n%s\r\n", 100, str_repeat("B", 100)) . "0\r\n\r\n"); | ||
| $response = stream_get_contents($fp); | ||
| fclose($fp); | ||
| echo "chunked within limit: ", str_contains($response, "200 OK") ? "200 OK" : "FAIL", "\n"; | ||
|
|
||
| // 8. Server must still be alive and serving normal requests. | ||
| $fp = php_cli_server_connect(); | ||
| fwrite($fp, "GET / HTTP/1.1\r\nHost: $host\r\nConnection: close\r\n\r\n"); | ||
| $response = stream_get_contents($fp); | ||
| fclose($fp); | ||
| echo "follow-up: ", str_contains($response, "200 OK") ? "200 OK" : "FAILED", "\n"; | ||
| ?> | ||
| --EXPECT-- | ||
| over post_max_size: 413 | ||
| shows configured limit: yes | ||
| over limit with body bytes: 413 | ||
| content-length overflow: rejected | ||
| chunked overflow: rejected | ||
| chunked over post_max_size: 413 | ||
| oversize chunk size: rejected | ||
| chunked within limit: 200 OK | ||
| follow-up: 200 OK |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can
client->request.content_len + lengthoverflow?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No.
lengthis capped by the 16 KB read buffer inphp_cli_server_client_read_request(), and the check keepscontent_lenat or belowpost_max_size, so the sum stays belowSIZE_MAX.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could you add an assertion and comment about this?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added.