Limit ChunkedDecoder trailer size to avoid unbounded buffering

Author: clue

src/Io/ChunkedDecoder.php

@@ -158,6 +158,10 @@ public function handleData($data)
             } elseif ($this->chunkSize === 0) {
                 if ($positionCrlf === false) {
                     // end chunk received, but trailer is incomplete
+                    // trailer shouldn't be bigger than 1024 bytes
+                    if (isset($this->buffer[static::MAX_CHUNK_HEADER_SIZE])) {
+                        $this->handleError(new Exception('Trailer size bigger than ' . static::MAX_CHUNK_HEADER_SIZE . ' bytes'));
+                    }
                     return;
                 }
                 // end chunk received, skip all trailer data

tests/Io/ChunkedDecoderTest.php

@@ -525,6 +525,22 @@ public function testEndChunkWithIncompleteTrailerWillEndOnceTrailerIsCompleted()
         $this->input->emit('data', ["\r\n\r\n"]);
     }
 
+    public function testEndChunkWithIncompleteTrailerIsTooBig()
+    {
+        $this->parser->on('data', $this->expectCallableNever());
+        $this->parser->on('close', $this->expectCallableOnce());
+        $this->parser->on('end', $this->expectCallableNever());
+        $this->parser->on('error', $this->expectCallableOnce());
+
+        $data = '';
+        for ($i = 0; $i < 1025; $i++) {
+            $data .= 'a';
+        }
+
+        // incomplete trailer must not be buffered without any limit
+        $this->input->emit('data', ["0\r\n" . $data]);
+    }
+
     public function testChunkFollowedByExactlyTwoNonCrlfBytesWillErrorAndNotCauseInfiniteLoop()
     {
         $this->parser->on('data', $this->expectCallableOnceWith('ab'));