Don't truncate header lengths to 32 bits

NEWS

@@ -109,6 +109,9 @@ PHP                                                                        NEWS
 - SAPI:
   . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
     (Martin Mirchev)
+  . Fixed header length truncation to 32 bits, which let setcookie() and
+    setrawcookie() skip the new line/NUL check for headers of 4 GiB or more.
+    (Jorg Sowa)
 
 - SOAP:
   . Fixed use of uninitialized func in do_request() on OOM bailout.

ext/standard/head.c

@@ -192,7 +192,7 @@ PHPAPI zend_result php_setcookie(zend_string *name, zend_string *value, time_t e
 	}
 
 	ctr.line = ZSTR_VAL(buf.s);
-	ctr.line_len = (uint32_t) ZSTR_LEN(buf.s);
+	ctr.line_len = ZSTR_LEN(buf.s);
 
 	result = sapi_header_op(SAPI_HEADER_ADD, &ctr);
 	zend_string_release(buf.s);

ext/standard/tests/network/setrawcookie_over_4gib.phpt

@@ -0,0 +1,18 @@
+--TEST--
+setrawcookie() checks the whole Set-Cookie line when it is longer than 4 GiB
+--SKIPIF--
+<?php
+if (!getenv('RUN_RESOURCE_HEAVY_TESTS')) die('skip resource-heavy test');
+if (PHP_INT_SIZE != 8) die('skip this test is for 64bit platforms only');
+if (getenv('SKIP_SLOW_TESTS')) die('skip slow tests excluded by request');
+?>
+--INI--
+memory_limit=-1
+--FILE--
+<?php
+// Cookie value validation stops at the first NUL byte, so it can sit past the first 4 GiB.
+var_dump(setrawcookie('name', str_repeat('a', 2**32) . "\0"));
+?>
+--EXPECTF--
+Warning: Header may not contain NUL bytes in %s on line %d
+bool(false)

main/SAPI.c

@@ -797,7 +797,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg)
 					PHP_STRLCPY(newheader, "Content-type: ", newlen, sizeof("Content-type: ")-1);
 					strlcat(newheader, mimetype, newlen);
 					sapi_header.header = newheader;
-					sapi_header.header_len = (uint32_t)(newlen - 1);
+					sapi_header.header_len = newlen - 1;
 					efree(header_line);
 				}
 				efree(mimetype);
@@ -904,7 +904,7 @@ SAPI_API int sapi_send_headers(void)
 
 				if (SG(sapi_headers).http_status_line) {
 					http_status_line.header = SG(sapi_headers).http_status_line;
-					http_status_line.header_len = (uint32_t)strlen(SG(sapi_headers).http_status_line);
+					http_status_line.header_len = strlen(SG(sapi_headers).http_status_line);
 				} else {
 					http_status_line.header = buf;
 					http_status_line.header_len = slprintf(buf, sizeof(buf), "HTTP/1.0 %d X", SG(sapi_headers).http_response_code);