From 493f64dda9c049ab55a8c497499a305b3e9f05f3 Mon Sep 17 00:00:00 2001 From: Alexandre Daubois Date: Mon, 22 Jun 2026 11:49:51 +0200 Subject: [PATCH] fix: prevent panic on malformed RemoteAddr in CGI variable builder --- cgi.go | 1 - cgi_test.go | 3 +++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/cgi.go b/cgi.go index 0fe6f2e30e..7f31c36293 100644 --- a/cgi.go +++ b/cgi.go @@ -46,7 +46,6 @@ var cStringHTTPMethods = map[string]*C.char{ // Inspired by https://github.com/caddyserver/caddy/blob/master/modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go func addKnownVariablesToServer(fc *frankenPHPContext, trackVarsArray *C.zval) { request := fc.request - // Separate remote IP and port; more lenient than net.SplitHostPort ip, port := splitRemoteAddr(request.RemoteAddr) var rs, https, sslProtocol *C.zend_string diff --git a/cgi_test.go b/cgi_test.go index 181797ccb8..3feffa3b54 100644 --- a/cgi_test.go +++ b/cgi_test.go @@ -47,10 +47,13 @@ func TestSplitRemoteAddr(t *testing.T) { {"ipv6 zone bracketed with port", "[fe80::1%eth0]:443", "fe80::1%eth0", "443"}, {"ipv4 without port", "192.168.0.1", "192.168.0.1", ""}, {"empty", "", "", ""}, + {"only colon", ":", "", ""}, // Must not panic: would crash the process via the cgo callback. {"lone open bracket", "[", "[", ""}, {"open bracket with port", "[:9000", "[", "9000"}, {"empty brackets", "[]", "", ""}, + {"opening bracket with colon", "[:", "[", ""}, + {"unterminated bracket with port", "[::1:80", "[::1", "80"}, } for _, tt := range tests {