From fbf3fbe5dad8cbeea6d44eadf5d3deaec4c632d4 Mon Sep 17 00:00:00 2001 From: Lazizbek Ergashev Date: Mon, 24 Aug 2026 01:59:59 +0500 Subject: [PATCH 1/2] sapi/cli: check php_cli_server_client_send_through() return value --- NEWS | 4 ++++ sapi/cli/php_cli_server.c | 5 +++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/NEWS b/NEWS index d25d441ca8b5..1f009ffef87f 100644 --- a/NEWS +++ b/NEWS @@ -8,6 +8,10 @@ PHP NEWS . Fixed bug GH-23301 (Nested "yield from" yields a value twice when the middle generator delegates again). (Lazizbek Ergashev) +- CLI: + . Fixed bug GH-23425 (sapi_cli_server_send_headers() does not check the + return value of php_cli_server_client_send_through()). (Lazizbek Ergashev) + - DOM: . Fixed a use-after-free when cloning a DOMNameSpaceNode after DOMDocument::xinclude(). (iliaal) diff --git a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c index f4d29ce56855..d8ed4525304b 100644 --- a/sapi/cli/php_cli_server.c +++ b/sapi/cli/php_cli_server.c @@ -578,10 +578,11 @@ static int sapi_cli_server_send_headers(sapi_headers_struct *sapi_headers) /* {{ } smart_str_appendl(&buffer, "\r\n", 2); - php_cli_server_client_send_through(client, ZSTR_VAL(buffer.s), ZSTR_LEN(buffer.s)); + size_t buffer_len = ZSTR_LEN(buffer.s); + bool sent = php_cli_server_client_send_through(client, ZSTR_VAL(buffer.s), buffer_len) == buffer_len; smart_str_free(&buffer); - return SAPI_HEADER_SENT_SUCCESSFULLY; + return sent ? SAPI_HEADER_SENT_SUCCESSFULLY : SAPI_HEADER_SEND_FAILED; } /* }}} */ From e2f8bcd0930b5e3f4a436f668efce56d3821b872 Mon Sep 17 00:00:00 2001 From: Lazizbek Ergashev Date: Mon, 24 Aug 2026 02:49:44 +0500 Subject: [PATCH 2/2] sapi/cli: report bytes actually sent on a failed send_through() --- sapi/cli/php_cli_server.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c index d8ed4525304b..9fb88d3ec734 100644 --- a/sapi/cli/php_cli_server.c +++ b/sapi/cli/php_cli_server.c @@ -1921,11 +1921,11 @@ static size_t php_cli_server_client_send_through(php_cli_server_client *client, } else { /* error or timeout */ php_handle_aborted_connection(); - return nbytes_left; + return str_len - nbytes_left; } } else { php_handle_aborted_connection(); - return nbytes_left; + return str_len - nbytes_left; } } nbytes_left -= nbytes_sent;