archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-18 06:58:55 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fixed MOPB-33-2007:PHP mail() Message ASCIIZ Byte Truncation

Browse source
This commit is contained in:
Ilia Alshanetsky 2007-03-27 00:13:09 +00:00
parent c0cd876a7f
commit ae1c5674cb
1 changed files with 21 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

22
ext/standard/mail.c
View file

@ -55,6 +55,14 @@
continue; \
} \
#define MAIL_ASCIIZ_CHECK(str, len) \
p = str; \
e = p + len; \
while (p = memchr(p, '\0', (e - p))) { \
*p = ' '; \
} \
/* {{{ proto int ezmlm_hash(string addr)
Calculate EZMLM list hash value. */
PHP_FUNCTION(ezmlm_hash)
@ -88,6 +96,7 @@ PHP_FUNCTION(mail)
int subject_len, extra_cmd_len, i;
char *force_extra_parameters = INI_STR("mail.force_extra_parameters");
char *to_r, *subject_r;
char *p, *e;
if (PG(safe_mode) && (ZEND_NUM_ARGS() == 5)) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "SAFE MODE Restriction in effect. The fifth parameter is disabled in SAFE MODE.");
@ -104,6 +113,17 @@ PHP_FUNCTION(mail)
return;
}
/* ASCIIZ check */
MAIL_ASCIIZ_CHECK(to, to_len);
MAIL_ASCIIZ_CHECK(subject, subject_len);
MAIL_ASCIIZ_CHECK(message, message_len);
if (headers) {
MAIL_ASCIIZ_CHECK(headers, headers_len);
}
if (extra_cmd) {
MAIL_ASCIIZ_CHECK(extra_cmd, extra_cmd_len);
}
if (to_len > 0) {
to_r = estrndup(to, to_len);
for (; to_len; to_len--) {
@ -150,7 +170,7 @@ PHP_FUNCTION(mail)
} else if (extra_cmd) {
extra_cmd = php_escape_shell_cmd(extra_cmd);
}
if (php_mail(to_r, subject_r, message, headers, extra_cmd TSRMLS_CC)) {
RETVAL_TRUE;
} else {