Bug #68180 [NEW]: iconv_mime_decode can return extra characters in a header

From: chad at mailchimp dot com Operating system: Linux/Debian/x86-64 PHP version: 5.6.1 Package: ICONV related Bug Type: Bug Bug description:iconv_mime_decode can return extra characters in a header Description: ------------ When ICONV's mime decoding functions are run against long strings with multi-byte character sets, extra characters not found in the input can be appended to the decoded value. This seems to be due to a bug in _php_iconv_appendl in ext/iconv/iconv.c that will sometimes advance the length of the smart_str past the location where iconv actually wrote the converted bytes. This happens when the string is not large enough to store the next multi-byte character, but has space remaining. I saw this with 5.5.17 and 5.6.1. Here's the configure script I used to build PHP 5.6.1 to reproduce the bug and test the patch: ./configure --build=x86_64-linux-gnu --host=x86_64-linux-gnu --with-iconv Test script: --------------- <?php $original = "=?UTF-8?Q?=E3=80=8E=E3=80=90=E5=A4=96=E8=B3=87=E7=B3=BB=E6=88=A6=E7=95=A5=E3=82=B3=E3=83=B3=E3=82=B5=E3=83=AB=E3=81=8C=E9=9B=86=E7=B5=90=E3=80=91=E3=83=88=E3=83=83=E3=83=97=E3=82=B3=E3=83=B3=E3=82=B5=E3=83=AB=E3=82=BF=E3=83=B3=E3=83=88=E3=81=A8=E8=A9=B1=E3=81=9B=E3=82=8B=E3=82=B3=E3=83=B3=E3=82=B5=E3=83=AB=E6=A5=AD=E7=95=8C=E7=A0=94=E7=A9=B6=E3=82=BB=E3=83=9F=E3=83=8A=E3=83=BC=E3=80=8F=E3=81=B8=E3=81=AE=E3=82=A8=E3=83=B3=E3=83=88=E3=83=AA=E3=83=BC=E3=81=82=E3=82=8A=E3=81=8C=E3=81=A8=E3=81=86=E3=81=94=E3=81=96=E3=81=84=E3=81=BE=E3=81=97=E3=81=9F=E3=80=82?="; $decoded = iconv_mime_decode($original, ICONV_MIME_DECODE_STRICT, 'utf-8'); $prefs = array('input-charset' => 'UTF-8', 'output-charset' => 'UTF-8', 'scheme' => 'Q', 'line-length' => 1000); $encoded = iconv_mime_encode('Subject', $decoded, $prefs); list($_, $encoded) = explode(' ', $encoded, 2); echo 'Before: ' . strlen($original) . ', After: ' . strlen($encoded) . "\n"; ?> Expected result: ---------------- Before: 561, After: 561 Actual result: -------------- Before: 561, After: 567 -- Edit bug report at https://bugs.php.net/bug.php?id=68180&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68180&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68180&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68180&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68180&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68180&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68180&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68180&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68180&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68180&r=support Expected behavior: https://bugs.php.net/fix.php?id=68180&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68180&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68180&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68180&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68180&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68180&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68180&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68180&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68180&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68180&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68180&r=mysqlcfg