Re: cvs: php4 /win32 sendmail.c

Why not using spprintf which does not require to allocate the buffer before calling the function? marcus At 00:10 03.06.2002, Markus Fischer wrote:

mfischer                Sun Jun  2 18:10:25 2002 EDT

Modified files:

    /php4/win32 sendmail.c

Log: - Try to fix most of the buffer overflows and dynamically allocate memory where

    applicable.

Index: php4/win32/sendmail.c diff -u php4/win32/sendmail.c:1.35 php4/win32/sendmail.c:1.36 --- php4/win32/sendmail.c:1.35 Sun Jun 2 13:13:48 2002

+++ php4/win32/sendmail.c       Sun Jun  2 18:10:25 2002

@@ -17,7 +17,7 @@ * */ -/* $Id: sendmail.c,v 1.35 2002/06/02 17:13:48 mfischer Exp $ */ +/* $Id: sendmail.c,v 1.36 2002/06/02 22:10:25 mfischer Exp $ */

 #include "php.h"                               /*php specific */

#include <stdio.h> @@ -319,7 +319,7 @@

                return (res);
        }

-       sprintf(Buffer, "MAIL FROM:<%s>\r\n", RPath);
+       snprintf(Buffer, MAIL_BUFFER_SIZE, "MAIL FROM:<%s>\r\n", RPath);
        if ((res = Post(Buffer)) != SUCCESS)
                return (res);
        if ((res = Ack(&server_response)) != SUCCESS) {

@@ -333,7 +333,7 @@

        token = strtok(tempMailTo, ",");
        while(token != NULL)
        {
-               sprintf(Buffer, "RCPT TO:<%s>\r\n", token);
+               snprintf(Buffer, MAIL_BUFFER_SIZE, "RCPT TO:<%s>\r\n", token);
                if ((res = Post(Buffer)) != SUCCESS)
                        return (res);
                if ((res = Ack(&server_response)) != SUCCESS) {

@@ -496,7 +496,13 @@

        return (SUCCESS);

} - +int addToHeader(char **header_buffer, const char *specifier, char *string) {

+       if (NULL == (*header_buffer = erealloc(*header_buffer, strlen(*header_buffer) + strlen(specifier) + strlen(string) + 1))) {
+               return 0;
+       }
+       sprintf(*header_buffer + strlen(*header_buffer), specifier, string);
+       return 1;

+} /********************************************************************* // Name: PostHeader @@ -520,7 +526,7 @@

        struct tm *tm = localtime(&tNow);
        int zoneh = abs(_timezone);
        int zonem, res;
-       char *p;
+       char *header_buffer;
        char *headers_lc = NULL;
        size_t i;

@@ -532,13 +538,16 @@

                        headers_lc[i] = tolower(headers_lc[i]);
                }
        }

-

-       p = Buffer;

+

+       if (NULL == (header_buffer = ecalloc(1, MAIL_BUFFER_SIZE))) {
+               efree(headers_lc);
+               return OUT_OF_MEMORY;
+       }
        zoneh /= (60 * 60);
        zonem = (abs(_timezone) / 60) - (zoneh * 60);

        if(!xheaders || !strstr(headers_lc, "date:")){
-               p += sprintf(p, "Date: %s, %02d %s %04d %02d:%02d:%02d %s%02d%02d\r\n",
+               sprintf(header_buffer, "Date: %s, %02d %s %04d %02d:%02d:%02d %s%02d%02d\r\n",
                                        days[tm->tm_wday],
                                        tm->tm_mday,
                                        months[tm->tm_mon],

@@ -551,24 +560,36 @@

                                        zonem);
        }

-       if(!headers_lc || !strstr(headers_lc, "from:")){
-               p += sprintf(p, "From: %s\r\n", RPath);
-       }
-       p += sprintf(p, "Subject: %s\r\n", Subject);
-       p += sprintf(p, "To: %s\r\n", mailTo);
+       if (!headers_lc || !strstr(headers_lc, "from:")) {
+               if (!addToHeader(&header_buffer, "From: %s\r\n", RPath)) {
+                       goto PostHeader_outofmem;
+               }
+       }
+       if (!addToHeader(&header_buffer, "Subject: %s\r\n", Subject)) {
+               goto PostHeader_outofmem;
+       }
+       if (!addToHeader(&header_buffer, "To: %s\r\n", mailTo)) {
+               goto PostHeader_outofmem;
+       }
        if (mailCc && *mailCc) {
-               p += sprintf(p, "Cc: %s\r\n", mailCc);
+               if (!addToHeader(&header_buffer, "Cc: %s\r\n", mailCc)) {
+               goto PostHeader_outofmem;
+               }
        }
        if(xheaders){
-               p += sprintf(p, "%s\r\n", xheaders);
-       }

-

-       if ((res = Post(Buffer)) != SUCCESS) {
+               if (!addToHeader(&header_buffer, "%s", xheaders)) {
+                       goto PostHeader_outofmem;
+               }
+       }

+

+       if ((res = Post(header_buffer)) != SUCCESS) {
+               efree(header_buffer);
                if (headers_lc) {
                        efree(headers_lc);
                }
                return (res);
-       }
+       }
+       efree(header_buffer);

        if ((res = Post("\r\n")) != SUCCESS) {
                if (headers_lc) {

@@ -577,7 +598,11 @@

                return (res);
        }

-       return (SUCCESS);
+       return (SUCCESS);

+ +PostHeader_outofmem:

+       efree(headers_lc);
+       return OUT_OF_MEMORY;

} -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php