[glbessa]

Fixes GH-24115.

PARSING_HEADER() in sapi/cli/php_http_parser.c excluded the F_TRAILING state, so the bytes of chunked request trailers were never counted in nread, and PHP_HTTP_MAX_HEADER_SIZE did not apply to them. A client could send an unbounded trailer section after the 0\r\n chunk.

The fix drops the F_TRAILING exception, so trailers are counted like regular headers. This is the same change upstream nodejs/http-parser made in 81ca70aec ("Avoid chunk trailer overflow").

Notes:

• nread is reset at the end of the regular headers, so trailers get their own 80 KB budget. Chunk sizes and chunk data are not counted.
• At the end of the trailers, nread is not reset before NEW_MESSAGE(). This does not matter today because the CLI server always replies with Connection: close. I can add a reset there if you prefer.

Test: sapi/cli/tests/gh24115.phpt sends a small trailer (200), a 100 KB trailer (rejected), and then checks that the server still answers. The test fails without the fix. I also ran a short randomized check with chunked bodies up to 200 KB and trailers up to 160 KB, and every response matched the limit.

🤖 Generated with Claude Code

[devnexen]

--- a/sapi/cli/tests/gh24115.phpt
+++ b/sapi/cli/tests/gh24115.phpt
@@ -14,7 +14,7 @@ $head = "POST / HTTP/1.1\r\nHost: $host\r\nTransfer-Encoding: chunked\r\nConnect

 function send(string $request): string {
     $fp = php_cli_server_connect();
-    fwrite($fp, $request);
+    @fwrite($fp, $request);
     $response = stream_get_contents($fp);
     fclose($fp);
     return $response;
@@ -26,7 +26,7 @@ echo "small trailer: ", str_contains($response, "200 OK") ? "200" : "FAIL", "\n"

 // A trailer larger than the header size limit is rejected.
 $response = send($head . "0\r\nX-Fill: " . str_repeat("A", 100 * 1024) . "\r\n\r\n");
-echo "oversized trailer: ", str_contains($response, "200 OK") ? "FAIL" : "rejected", "\n";
+echo "oversized trailer: ", $response === '' ? "rejected" : "FAIL", "\n";

 // The server keeps serving requests afterwards.
 $response = send($head . "0\r\n\r\n");