Fix infinite loop in sapi_header_op() for headers of 4 GiB or more

NEWS

@@ -26,6 +26,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-24321 (ZTS: global_map_ptr_last survives zend_shutdown(),
     so an in-process engine restart keeps growing the map_ptr table).
     (David Carlier)
+  . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
+    (Martin Mirchev)
 
 - Date:
   . Fixed bug GH-20503 (Assertion failure with ext/date DateInterval property

ext/standard/tests/general_functions/header_over_4gib.phpt

@@ -0,0 +1,20 @@
+--TEST--
+header() with a header line longer than 4 GiB
+--SKIPIF--
+<?php
+if (!getenv('RUN_RESOURCE_HEAVY_TESTS')) die('skip resource-heavy test');
+if (PHP_INT_SIZE != 8) die('skip this test is for 64bit platforms only');
+if (getenv('SKIP_SLOW_TESTS')) die('skip slow tests excluded by request');
+?>
+--INI--
+memory_limit=-1
+--FILE--
+<?php
+// The new line/NUL check in sapi_header_op() used a 32-bit index, so a header
+// line of 4 GiB or more made it loop forever.
+header('X-Foo: ' . str_repeat('a', 2**32) . "\nX-Bar: b");
+echo "Done\n";
+?>
+--EXPECTF--
+Warning: Header may not contain more than a single header, new line detected in %s on line %d
+Done

main/SAPI.c

@@ -742,7 +742,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg)
 		return SUCCESS;
 	} else {
 		/* new line/NUL character safety check */
-		uint32_t i;
+		size_t i;
 		for (i = 0; i < header_line_len; i++) {
 			/* RFC 7230 ch. 3.2.4 deprecates folding support */
 			if (header_line[i] == '\n' || header_line[i] == '\r') {