iliaa Tue Mar 27 00:14:17 2007 UTC
Modified files: (Branch: PHP_4_4)
/php-src/ext/standard mail.c
/php-src NEWS
Log:
MFB: MOPB-33-2007:PHP mail() Message ASCIIZ Byte Truncation
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/mail.c?r1=1.66.2.12.4.3&r2=1.66.2.12.4.4&diff_format=u
Index: php-src/ext/standard/mail.c
diff -u php-src/ext/standard/mail.c:1.66.2.12.4.3
php-src/ext/standard/mail.c:1.66.2.12.4.4
--- php-src/ext/standard/mail.c:1.66.2.12.4.3 Mon Jan 1 09:46:48 2007
+++ php-src/ext/standard/mail.c Tue Mar 27 00:14:16 2007
@@ -16,7 +16,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: mail.c,v 1.66.2.12.4.3 2007/01/01 09:46:48 sebastian Exp $ */
+/* $Id: mail.c,v 1.66.2.12.4.4 2007/03/27 00:14:16 iliaa Exp $ */
#include <stdlib.h>
#include <ctype.h>
@@ -55,6 +55,14 @@
continue;
\
}
\
+#define MAIL_ASCIIZ_CHECK(str, len) \
+ p = str; \
+ e = p + len; \
+ while (p = memchr(p, '\0', (e - p))) { \
+ *p = ' '; \
+ } \
+
+
/* {{{ proto int ezmlm_hash(string addr)
Calculate EZMLM list hash value. */
PHP_FUNCTION(ezmlm_hash)
@@ -87,6 +95,7 @@
int to_len, message_len, headers_len;
int subject_len, extra_cmd_len, i;
char *to_r, *subject_r;
+ char *p, *e;
if (PG(safe_mode) && (ZEND_NUM_ARGS() == 5)) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "SAFE MODE
Restriction in effect. The fifth parameter is disabled in SAFE MODE.");
@@ -103,6 +112,17 @@
return;
}
+ /* ASCIIZ check */
+ MAIL_ASCIIZ_CHECK(to, to_len);
+ MAIL_ASCIIZ_CHECK(subject, subject_len);
+ MAIL_ASCIIZ_CHECK(message, message_len);
+ if (headers) {
+ MAIL_ASCIIZ_CHECK(headers, headers_len);
+ }
+ if (extra_cmd) {
+ MAIL_ASCIIZ_CHECK(extra_cmd, extra_cmd_len);
+ }
+
if (to_len > 0) {
to_r = estrndup(to, to_len);
for (; to_len; to_len--) {
@@ -147,7 +167,7 @@
if (extra_cmd) {
extra_cmd = php_escape_shell_cmd(extra_cmd);
}
-
+
if (php_mail(to_r, subject_r, message, headers, extra_cmd TSRMLS_CC)) {
RETVAL_TRUE;
} else {
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.1247.2.920.2.217&r2=1.1247.2.920.2.218&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.1247.2.920.2.217 php-src/NEWS:1.1247.2.920.2.218
--- php-src/NEWS:1.1247.2.920.2.217 Mon Mar 26 11:19:37 2007
+++ php-src/NEWS Tue Mar 27 00:14:16 2007
@@ -1,6 +1,7 @@
PHP 4 NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? 2007, Version 4.4.7
+- Fixed MOPB-33-2007 PHP mail() Message ASCIIZ Byte Truncation. (Ilia)
- Fixed CRLF injection inside ftp_putcmd(). (Ilia)
- Fixed MOPB-32-2007 (Double free inside session_decode()). (Ilia)
- Fixed MOPB-21-2007 An open_basedir/safe_mode bypass inside the
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
