From 53bc437fb46a4f97948485d808049956ef0ef362 Mon Sep 17 00:00:00 2001
From: Gabriel Leite Bessa <gabrielleitebessa@gmail.com>
Date: Fri, 30 Oct 2026 04:17:35 -0300
Subject: [PATCH] Fix GH-24115: CLI server chunked trailers bypass header size
 limit

PARSING_HEADER() excluded the F_TRAILING state, so bytes of chunked request trailers were never counted against PHP_HTTP_MAX_HEADER_SIZE. Count them like regular headers, as done upstream in nodejs/http-parser 81ca70aec.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 sapi/cli/php_http_parser.c  |  2 +-
 sapi/cli/tests/gh24115.phpt | 38 +++++++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 sapi/cli/tests/gh24115.phpt

diff --git a/sapi/cli/php_http_parser.c b/sapi/cli/php_http_parser.c
index 252c5fcf7598..abaa595091d8 100644
--- a/sapi/cli/php_http_parser.c
+++ b/sapi/cli/php_http_parser.c
@@ -195,7 +195,7 @@ static const uint8_t normal_url_char[256] = {
         1,       1,       1,       1,       1,       1,       1,       0 };
 
 
-#define PARSING_HEADER(state) (state <= s_headers_almost_done && 0 == (parser->flags & F_TRAILING))
+#define PARSING_HEADER(state) (state <= s_headers_almost_done)
 
 
 enum header_states
diff --git a/sapi/cli/tests/gh24115.phpt b/sapi/cli/tests/gh24115.phpt
new file mode 100644
index 000000000000..02e3d18696b0
--- /dev/null
+++ b/sapi/cli/tests/gh24115.phpt
@@ -0,0 +1,38 @@
+--TEST--
+GH-24115 (CLI server: chunked request trailers are not limited by the header size limit)
+--SKIPIF--
+<?php
+include "skipif.inc";
+?>
+--FILE--
+<?php
+include "php_cli_server.inc";
+php_cli_server_start("echo 'OK';");
+
+$host = PHP_CLI_SERVER_HOSTNAME;
+$head = "POST / HTTP/1.1\r\nHost: $host\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n4\r\ndata\r\n";
+
+function send(string $request): string {
+    $fp = php_cli_server_connect();
+    fwrite($fp, $request);
+    $response = stream_get_contents($fp);
+    fclose($fp);
+    return $response;
+}
+
+// A small trailer is still accepted.
+$response = send($head . "0\r\nX-Trailer: small\r\n\r\n");
+echo "small trailer: ", str_contains($response, "200 OK") ? "200" : "FAIL", "\n";
+
+// A trailer larger than the header size limit is rejected.
+$response = send($head . "0\r\nX-Fill: " . str_repeat("A", 100 * 1024) . "\r\n\r\n");
+echo "oversized trailer: ", str_contains($response, "200 OK") ? "FAIL" : "rejected", "\n";
+
+// The server keeps serving requests afterwards.
+$response = send($head . "0\r\n\r\n");
+echo "after rejection: ", str_contains($response, "200 OK") ? "200" : "FAIL", "\n";
+?>
+--EXPECT--
+small trailer: 200
+oversized trailer: rejected
+after rejection: 200