cvs: php4 /win32 sendmail.c

mfischer Sun Jun 2 18:10:25 2002 EDT Modified files: /php4/win32 sendmail.c Log: - Try to fix most of the buffer overflows and dynamically allocate memory where applicable. Index: php4/win32/sendmail.c diff -u php4/win32/sendmail.c:1.35 php4/win32/sendmail.c:1.36 --- php4/win32/sendmail.c:1.35 Sun Jun 2 13:13:48 2002 +++ php4/win32/sendmail.c Sun Jun 2 18:10:25 2002 @@ -17,7 +17,7 @@ * */ -/* $Id: sendmail.c,v 1.35 2002/06/02 17:13:48 mfischer Exp $ */ +/* $Id: sendmail.c,v 1.36 2002/06/02 22:10:25 mfischer Exp $ */ #include "php.h" /*php specific */ #include <stdio.h> @@ -319,7 +319,7 @@ return (res); } - sprintf(Buffer, "MAIL FROM:<%s>\r\n", RPath); + snprintf(Buffer, MAIL_BUFFER_SIZE, "MAIL FROM:<%s>\r\n", RPath); if ((res = Post(Buffer)) != SUCCESS) return (res); if ((res = Ack(&server_response)) != SUCCESS) { @@ -333,7 +333,7 @@ token = strtok(tempMailTo, ","); while(token != NULL) { - sprintf(Buffer, "RCPT TO:<%s>\r\n", token); + snprintf(Buffer, MAIL_BUFFER_SIZE, "RCPT TO:<%s>\r\n", token); if ((res = Post(Buffer)) != SUCCESS) return (res); if ((res = Ack(&server_response)) != SUCCESS) { @@ -496,7 +496,13 @@ return (SUCCESS); } - +int addToHeader(char **header_buffer, const char *specifier, char *string) { + if (NULL == (*header_buffer = erealloc(*header_buffer, strlen(*header_buffer) + strlen(specifier) + strlen(string) + 1))) { + return 0; + } + sprintf(*header_buffer + strlen(*header_buffer), specifier, string); + return 1; +} /********************************************************************* // Name: PostHeader @@ -520,7 +526,7 @@ struct tm *tm = localtime(&tNow); int zoneh = abs(_timezone); int zonem, res; - char *p; + char *header_buffer; char *headers_lc = NULL; size_t i; @@ -532,13 +538,16 @@ headers_lc[i] = tolower(headers_lc[i]); } } - - p = Buffer; + + if (NULL == (header_buffer = ecalloc(1, MAIL_BUFFER_SIZE))) { + efree(headers_lc); + return OUT_OF_MEMORY; + } zoneh /= (60 * 60); zonem = (abs(_timezone) / 60) - (zoneh * 60); if(!xheaders || !strstr(headers_lc, "date:")){ - p += sprintf(p, "Date: %s, %02d %s %04d %02d:%02d:%02d %s%02d%02d\r\n", + sprintf(header_buffer, "Date: %s, %02d %s %04d %02d:%02d:%02d %s%02d%02d\r\n", days[tm->tm_wday], tm->tm_mday, months[tm->tm_mon], @@ -551,24 +560,36 @@ zonem); } - if(!headers_lc || !strstr(headers_lc, "from:")){ - p += sprintf(p, "From: %s\r\n", RPath); - } - p += sprintf(p, "Subject: %s\r\n", Subject); - p += sprintf(p, "To: %s\r\n", mailTo); + if (!headers_lc || !strstr(headers_lc, "from:")) { + if (!addToHeader(&header_buffer, "From: %s\r\n", RPath)) { + goto PostHeader_outofmem; + } + } + if (!addToHeader(&header_buffer, "Subject: %s\r\n", Subject)) { + goto PostHeader_outofmem; + } + if (!addToHeader(&header_buffer, "To: %s\r\n", mailTo)) { + goto PostHeader_outofmem; + } if (mailCc && *mailCc) { - p += sprintf(p, "Cc: %s\r\n", mailCc); + if (!addToHeader(&header_buffer, "Cc: %s\r\n", mailCc)) { + goto PostHeader_outofmem; + } } if(xheaders){ - p += sprintf(p, "%s\r\n", xheaders); - } - - if ((res = Post(Buffer)) != SUCCESS) { + if (!addToHeader(&header_buffer, "%s", xheaders)) { + goto PostHeader_outofmem; + } + } + + if ((res = Post(header_buffer)) != SUCCESS) { + efree(header_buffer); if (headers_lc) { efree(headers_lc); } return (res); - } + } + efree(header_buffer); if ((res = Post("\r\n")) != SUCCESS) { if (headers_lc) { @@ -577,7 +598,11 @@ return (res); } - return (SUCCESS); + return (SUCCESS); + +PostHeader_outofmem: + efree(headers_lc); + return OUT_OF_MEMORY; }