Fix GH-24536: Built-in server crashes on a huge chunk size or Content-Length

NEWS

@@ -27,6 +27,10 @@ PHP                                                                        NEWS
     so an in-process engine restart keeps growing the map_ptr table).
     (David Carlier)
 
+- CLI:
+  . Fixed bug GH-24536 (Built-in server crashes on a huge chunk size or
+    Content-Length). (lazerg)
+
 - Date:
   . Fixed bug GH-20503 (Assertion failure with ext/date DateInterval property
     hash construction). (heathdutton)

sapi/cli/php_cli_server.c

@@ -1803,10 +1803,6 @@ static int php_cli_server_client_read_request_on_headers_complete(php_http_parse
 static int php_cli_server_client_read_request_on_body(php_http_parser *parser, const char *at, size_t length)
 {
 	php_cli_server_client *client = parser->data;
-	if (!client->request.content) {
-		client->request.content = pemalloc(parser->content_length, 1);
-		client->request.content_len = 0;
-	}
 	client->request.content = perealloc(client->request.content, client->request.content_len + length, 1);
 	memmove(client->request.content + client->request.content_len, at, length);
 	client->request.content_len += length;

sapi/cli/php_http_parser.c

@@ -27,6 +27,8 @@
 # define MIN(a,b) ((a) < (b) ? (a) : (b))
 #endif
 
+#define MAX_CONTENT_LENGTH ((ssize_t)(SIZE_MAX >> 1))
+
 
 #define CALLBACK2(FOR)                                               \
 do {                                                                 \
@@ -1228,6 +1230,7 @@ size_t php_http_parser_execute (php_http_parser *parser,
           case h_content_length:
             if (ch == ' ') break;
             if (ch < '0' || ch > '9') goto error;
+            if (parser->content_length > (MAX_CONTENT_LENGTH - (ch - '0')) / 10) goto error;
             parser->content_length *= 10;
             parser->content_length += ch - '0';
             break;
@@ -1433,6 +1436,7 @@ size_t php_http_parser_execute (php_http_parser *parser,
           goto error;
         }
 
+        if (parser->content_length > (MAX_CONTENT_LENGTH - c) / 16) goto error;
         parser->content_length *= 16;
         parser->content_length += c;
         break;

sapi/cli/tests/gh24536.phpt

@@ -0,0 +1,41 @@
+--TEST--
+GH-24536 (Built-in server crashes on a huge chunk size or Content-Length)
+--SKIPIF--
+<?php
+include "skipif.inc";
+?>
+--FILE--
+<?php
+include "php_cli_server.inc";
+php_cli_server_start();
+
+$host = PHP_CLI_SERVER_HOSTNAME;
+
+$fp = php_cli_server_connect();
+fwrite($fp, "POST / HTTP/1.1\r\nHost: {$host}\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF\r\nAAAAAAAA");
+stream_socket_shutdown($fp, STREAM_SHUT_WR);
+var_dump(stream_get_contents($fp));
+fclose($fp);
+
+$fp = php_cli_server_connect();
+fwrite($fp, "POST / HTTP/1.1\r\nHost: {$host}\r\nContent-Length: " . PHP_INT_MAX . "\r\n\r\nAAAAAAAA");
+stream_socket_shutdown($fp, STREAM_SHUT_WR);
+var_dump(stream_get_contents($fp));
+fclose($fp);
+
+$fp = php_cli_server_connect();
+fwrite($fp, "GET / HTTP/1.1\r\nHost: {$host}\r\nConnection: close\r\n\r\n");
+fpassthru($fp);
+fclose($fp);
+?>
+--EXPECTF--
+string(0) ""
+string(0) ""
+HTTP/1.1 200 OK
+Host: %s
+Date: %s
+Connection: close
+X-Powered-By: PHP/%s
+Content-type: text/html; charset=UTF-8
+
+Hello world