Fix GHSA-4w77-75f9-2c8w

(cherry picked from commit 7dd336ae838bbf2c62dc47e3c900d657d3534c02)
(cherry picked from commit 462092a)
(cherry picked from commit 56488a8)
(cherry picked from commit 6b8357c)
(cherry picked from commit b7c951d)
(cherry picked from commit abd3bf9)

Author: nielsdos

sapi/cli/php_cli_server.c

@@ -1815,18 +1815,14 @@ static size_t php_cli_server_client_send_through(php_cli_server_client *client,
 
 static void php_cli_server_client_populate_request_info(const php_cli_server_client *client, sapi_request_info *request_info) /* {{{ */
 {
-	char *val;
-
 	request_info->request_method = php_http_method_str(client->request.request_method);
 	request_info->proto_num = client->request.protocol_version;
 	request_info->request_uri = client->request.request_uri;
 	request_info->path_translated = client->request.path_translated;
 	request_info->query_string = client->request.query_string;
 	request_info->content_length = client->request.content_len;
 	request_info->auth_user = request_info->auth_password = request_info->auth_digest = NULL;
-	if (NULL != (val = zend_hash_str_find_ptr(&client->request.headers, "content-type", sizeof("content-type")-1))) {
-		request_info->content_type = val;
-	}
+	request_info->content_type = zend_hash_str_find_ptr(&client->request.headers, "content-type", sizeof("content-type")-1);
 } /* }}} */
 
 static void destroy_request_info(sapi_request_info *request_info) /* {{{ */

sapi/cli/tests/ghsa-4w77-75f9-2c8w.phpt

@@ -0,0 +1,41 @@
+--TEST--
+GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface)
+--INI--
+allow_url_fopen=1
+--SKIPIF--
+<?php
+include "skipif.inc";
+?>
+--FILE--
+<?php
+include "php_cli_server.inc";
+
+$serverCode = <<<'CODE'
+var_dump(file_get_contents('php://input'));
+CODE;
+
+php_cli_server_start($serverCode, null);
+
+$options = [
+    "http" => [
+        "method" => "POST",
+        "header" => "Content-Type: application/x-www-form-urlencoded",
+        "content" => "AAAAA",
+    ],
+];
+$context = stream_context_create($options);
+
+echo file_get_contents("http://" . PHP_CLI_SERVER_ADDRESS . "/", false, $context);
+
+$options = [
+    "http" => [
+        "method" => "POST",
+    ],
+];
+$context = stream_context_create($options);
+
+echo file_get_contents("http://" . PHP_CLI_SERVER_ADDRESS . "/", false, $context);
+?>
+--EXPECT--
+string(5) "AAAAA"
+string(0) ""