From:             [EMAIL PROTECTED]
Operating system: Windows 2000
PHP version:      4.1.1
PHP Bug Type:     Reproducible crash
Bug description:  mail function buffer overflow

from win32\sendmail.h :

#define  MAIL_BUFFER_SIZE               (1024*4)        /* 4k buffer */

sendmail.c uses sprintf's to this buffer without range checking resulting
in a crash of php in most of the cases when the "extra headers" surpass
4k.

Im working on a fixed version of sendmail.c if your interested.

ciao,
Enrico
-- 
Edit bug report at: http://bugs.php.net/?id=14983&edit=1


-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]

Reply via email to