Merge commit from fork

[3.x] Enforce client response max headers size

Author: WyriHaximus

src/Io/ClientRequestStream.php

@@ -23,6 +23,8 @@ class ClientRequestStream extends EventEmitter implements WritableStreamInterfac
     const STATE_HEAD_WRITTEN = 2;
     const STATE_END = 3;
 
+    private $maxHeaderSize = 65536;
+
     /** @var ClientConnectionManager */
     private $connectionManager;
 
@@ -156,6 +158,19 @@ public function handleData($data)
         // buffer until double CRLF (or double LF for compatibility with legacy servers)
         $eom = \strpos($this->buffer, "\r\n\r\n");
         $eomLegacy = \strpos($this->buffer, "\n\n");
+        $eomMaxHeaderSize = $eom;
+        if ($eomLegacy !== false && ($eom === false || $eomLegacy < $eom)) {
+            $eomMaxHeaderSize = $eomLegacy;
+        }
+
+        // reject response if buffer size is exceeded
+        if ($eomMaxHeaderSize > $this->maxHeaderSize || ($eomMaxHeaderSize === false && isset($this->buffer[$this->maxHeaderSize]))) {
+            $this->closeError(
+                new \OverflowException('Maximum response header size of ' . $this->maxHeaderSize . ' bytes exceeded.')
+            );
+            return;
+        }
+
         if ($eom !== false || $eomLegacy !== false) {
             try {
                 if ($eom !== false && ($eomLegacy === false || $eom < $eomLegacy)) {

tests/Io/ClientRequestStreamTest.php

@@ -184,6 +184,43 @@ public function requestShouldEmitErrorIfRequestParserThrowsException()
         $request->handleData("\r\n\r\n");
     }
 
+    public static function provideResponseHeaderOverflow()
+    {
+        $data = "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nX-Data: ";
+        $data .= str_repeat('A', 65537 - strlen($data)) . "\r\n\r\n";
+
+        $legacy = "HTTP/1.1 200 OK\r\n";
+        $legacy .= str_repeat('A', 65537 - strlen($legacy)) . "\n\n";
+
+        return [
+            'without end of message' => [str_repeat('A', 65537)],
+            'with end of message' => [$data],
+            'with legacy end of message' => [$legacy],
+        ];
+    }
+
+    /**
+     * @dataProvider provideResponseHeaderOverflow
+     * @param string $data
+     */
+    public function testRequestShouldEmitErrorWhenResponseHeadersExceedMaximumSize($data)
+    {
+        $connection = $this->getMockBuilder('React\Socket\ConnectionInterface')->getMock();
+
+        $connectionManager = $this->getMockBuilder('React\Http\Io\ClientConnectionManager')->disableOriginalConstructor()->getMock();
+        $connectionManager->expects($this->once())->method('connect')->willReturn(\React\Promise\resolve($connection));
+
+        $requestData = new Request('GET', 'http://www.example.com');
+        $request = new ClientRequestStream($connectionManager, $requestData);
+
+        $request->on('response', $this->expectCallableNever());
+        $request->on('error', $this->expectCallableOnceWith($this->isInstanceOf('OverflowException')));
+        $request->on('close', $this->expectCallableOnce());
+
+        $request->end();
+        $request->handleData($data);
+    }
+
     /** @test */
     public function getRequestShouldSendAGetRequest()
     {