[2020-06-21 18:58 UTC] sam dot revitch at protonmail dot ch

Description:
------------
When FPM receives records:

FCGI_BEGIN_REQUEST,
FCGI_PARAMS, including CONTENT_LENGTH=x
one or more nonempty FCGI_STDIN, with a total data length of y < x, and
FCGI_STDIN end-of-stream (empty data)

And the script reads php://input to the end, the read will hang until the socket is closed.  This is because sapi_cgi_read_post() expects CONTENT_LENGTH bytes, and does not appear to honor the FastCGI end-of-stream indicator if it receives fewer.

This is an edge case.  I stumbled upon it using Apache, mod_proxy_fcgi, and mod_security, where mod_security aborts a request based on part of the body.  It's certainly a bug that Apache doesn't close the FastCGI socket or send an abort record.  However, PHP shouldn't be hanging indefinitely after receiving an end-of-stream.