- Implemented request #44164, zlib.output_compression is now implicitly

  disabled when the header "Content-length" is set.
#One could argue that any output handler could change the size of the
#response, so this exception for zlib.output_compression is an
#inconsistency. However, zlib.output_compression is presented as a
#performance setting, whose value should have no effect on the
#correctness of the scripts. This was not the case. Setting the
#header "content-length" and enabling zlib.output_compression was
#a recipe for infringing section 4.4 of RFC 2616.

Author: cataphract

main/SAPI.c

@@ -706,6 +706,14 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 				}
 				efree(mimetype);
 				SG(sapi_headers).send_default_content_type = 0;
+			} else if (!STRCASECMP(header_line, "Content-Length")) {
+				/* Script is setting Content-length. The script cannot reasonably
+				 * know the size of the message body after compression, so it's best
+				 * do disable compression altogether. This contributes to making scripts
+				 * portable between setups that have and don't have zlib compression
+				 * enabled globally. See req #44164 */
+				zend_alter_ini_entry("zlib.output_compression", sizeof("zlib.output_compression"),
+					"0", sizeof("0") - 1, PHP_INI_USER, PHP_INI_STAGE_RUNTIME);
 			} else if (!STRCASECMP(header_line, "Location")) {
 				if ((SG(sapi_headers).http_response_code < 300 ||
 					SG(sapi_headers).http_response_code > 307) &&

tests/basic/req44164.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Req #44164 (Handle "Content-Length" HTTP header when zlib.output_compression active)
+--SKIPIF--
+<?php
+if (!function_exists('gzdeflate'))
+    die("skip zlib extension required");
+?>
+--INI--
+zlib.output_compression=On
+--ENV--
+HTTP_ACCEPT_ENCODING=gzip
+--FILE--
+<?php
+header("Content-length: 200");
+echo str_repeat("a", 200);
+--EXPECT--
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa