#22262 [NEW]: CRLF incorrectly converted to CRCRLF

From: adamness at yahoo dot com Operating system: FreeBSD 4.3 PHP version: 4.3.0 PHP Bug Type: Mail related Bug description: CRLF incorrectly converted to CRCRLF The RFC's require lines in the email header to end in "\r\n". However, when using the mail function in PHP 4.3, and qmail-inject as the external mail program, the mail function was silently replacing my \n's with \r\n's, leaving me with "\r\r\n", which actually ends up violating the RFC, in a way that can cause buffer overflows in some mailreaders, and has been identified as a possible virus exploit by several virus scanners. For a solution, the mail function, before replacing a \n with \r\n should check if the previous character is already a \r. -- Edit bug report at http://bugs.php.net/?id=22262&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=22262&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=22262&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=22262&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=22262&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=22262&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=22262&r=support Expected behavior: http://bugs.php.net/fix.php?id=22262&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=22262&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=22262&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=22262&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=22262&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=22262&r=dst IIS Stability: http://bugs.php.net/fix.php?id=22262&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=22262&r=gnused