#26008 [NEW]: mail() crashes apache with some parameters

From: rich at tallman dot org Operating system: Windows XP PHP version: 4.3.3 PHP Bug Type: Mail related Bug description: mail() crashes apache with some parameters Description: ------------ Any script passing invalid headers will result in a crash of the apache web server when using the apache module version of php 4.3.3 (from the binary zip download) This particular type of invalid header is commonly used to circumvent other unpredictable strange behaviors with the mail command. Reproduce code: --------------- mail("rich@tallman.org","test message","","From: rich@tallman.org\n\nThis is a test message."); Expected result: ---------------- Apache will crash (usually creating a windows XP error window) Actual result: -------------- szAppName : Apache.exe szAppVer : 2.0.47.0 szModName : php4ts.dll szModVer : 4.3.3.3 offset : 0009defe -- Edit bug report at http://bugs.php.net/?id=26008&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=26008&r=trysnapshot4 Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=26008&r=trysnapshot5 Fixed in CVS: http://bugs.php.net/fix.php?id=26008&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=26008&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=26008&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=26008&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=26008&r=support Expected behavior: http://bugs.php.net/fix.php?id=26008&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=26008&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=26008&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=26008&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=26008&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=26008&r=dst IIS Stability: http://bugs.php.net/fix.php?id=26008&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=26008&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=26008&r=float