Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

HTTP wrapper leaks Location buffer when an empty Location header is followed by another Location header

未关闭 适合新手
  • 哪里不对？
#24,509 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
78/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
c, php
领域
backend, networking

调研方向

从ext/standard/http_fopen_wrapper.c中的php_stream_http_response_headers_parse()开始，检查重复的Location头如何分配和调整缓冲区大小。报告包含使用server.php和client.php复现内存泄漏的方法；使用调试版 PHP 构建并设置report_memleaks=1运行。完成标准是：空头之后接非空头的序列不再报告泄漏，同时重复的非空Location头仍按描述运行。

由索引模型根据 Issue 内容生成。

描述

Bug Status: Needs Triage
Description

The following code:

server.php (run first, php server.php):

<?php
$srv = stream_socket_server("tcp://127.0.0.1:18233", $errno, $errstr);
$conn = stream_socket_accept($srv);
while (($line = fgets($conn, 8192)) !== false) { if (trim($line) === '') break; }
// empty Location value, then a real one
fwrite($conn, "HTTP/1.1 302 Found\r\nLocation:\r\nLocation: /abcdefghijklmno\r\n\r\n");
fclose($conn);

client.php (debug build, php -d report_memleaks=1 client.php):

<?php
@file_get_contents("http://127.0.0.1:18233/");

Resulted in this output:

ext/standard/http_fopen_wrapper.c(341) :  Freeing 0x... (16 bytes), script=.../client.php
=== Total 1 memory leaks detected ===

But I expected this output instead:

(no leaks reported)

Root cause: the wrapper stores the Location value using location_len == 0 as the "nothing allocated yet" sentinel (ext/standard/http_fopen_wrapper.c:340 in 8.5.12, :327 on master):

if (header_info->location_len == 0) {
    header_info->location = emalloc(last_header_value_len + 1);
} else if (header_info->location_len <= last_header_value_len) {
    header_info->location = erealloc(header_info->location, last_header_value_len + 1);
}
header_info->location_len = last_header_value_len;

An empty Location: header allocates a 1-byte buffer and then sets location_len = 0, restoring the sentinel state while the pointer is still held. A second Location header takes the emalloc branch again and the first buffer is leaked. Each empty-then-nonempty sequence leaks one buffer per request.

Control (two non-empty Location headers): 0 leaks. Reproduces on current master (8.7.0-dev) as well.

Suggested patch (verified against master: 0 leaks after patching; repeated non-empty Location headers still take the erealloc path and behave as before). header_info is zero-initialized by php_stream_http_response_header_info_init, so the pointer works as the sentinel:

--- a/ext/standard/http_fopen_wrapper.c
+++ b/ext/standard/http_fopen_wrapper.c
@@ -324,7 +324,9 @@ static zend_string *php_stream_http_response_headers_parse(php_stream_wrapper *w
 			zend_string_efree(last_header_line);
 			return NULL;
 		}
-		if (header_info->location_len == 0) {
+		/* An empty Location value leaves location_len at 0, so the buffer
+		 * pointer, not the length, must be the "already allocated" test. */
+		if (header_info->location == NULL) {
 			header_info->location = emalloc(last_header_value_len + 1);
 		} else if (header_info->location_len <= last_header_value_len) {
 			header_info->location = erealloc(header_info->location, last_header_value_len + 1);
PHP Version
PHP 8.5.12 (also reproduces on master, 8.7.0-dev)
Operating System

Linux x86_64

主要语言
C
星标
40.4k
派生
8.2k
平均合并
2 天 22 小时
30 天内合并 PR
166

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

php/php-src 的其他 Issue

查看 php/php-src 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。