File php7-CVE-2026-93682.patch of Package php7

From 547566f17a12b4900efb69a7cf8cd325d00613a2 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Mon, 24 Aug 2026 12:05:47 -0400
Subject: [PATCH] [http] Fix out-of-bounds read on empty Location header

An empty Location header allocates a single byte for the NUL
terminator, so reading location[1] in the relative-redirect branch
over-reads heap memory and could append a garbage-derived path to the
redirect target instead of the correct host root. Use location_len
instead of strlen, and skip the relative join when location_len is 0,
so the second byte is never read.

Closes GH-23467
---
 ext/standard/http_fopen_wrapper.c             |  4 +--
 .../http/http_empty_location_redirect.phpt    | 36 +++++++++++++++++++
 2 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 ext/standard/tests/http/http_empty_location_redirect.phpt

Index: php-7.4.33/ext/standard/http_fopen_wrapper.c
===================================================================
--- php-7.4.33.orig/ext/standard/http_fopen_wrapper.c
+++ php-7.4.33/ext/standard/http_fopen_wrapper.c
@@ -1034,7 +1034,7 @@ finish:
 
 			char *new_path = NULL;
 
-                        if (strlen(header_info.location) < 8 ||
+			if (header_info.location_len < 8 ||
                                         (strncasecmp(header_info.location, "http://", sizeof("http://")-1) &&
                                                         strncasecmp(header_info.location, "https://", sizeof("https://")-1) &&
                                                         strncasecmp(header_info.location, "ftp://", sizeof("ftp://")-1) &&
@@ -1042,7 +1042,7 @@ finish:
 			{
 				char *loc_path = NULL;
                                 if (*header_info.location != '/') {
-                                        if (*(header_info.location+1) != '\0' && resource->path) {
+					if (header_info.location_len > 0 && resource->path) {
 						char *s = strrchr(ZSTR_VAL(resource->path), '/');
 						if (!s) {
 							s = ZSTR_VAL(resource->path);