cvs: php4 /ext/standard mail.c

sesser Thu Jun 13 14:54:46 2002 EDT Modified files: /php4/ext/standard mail.c Log: Fixed: possible bufferunderrun (worst case == invalid free bytes counter) Fixed: isXXXX macros need (unsigned char) cast Fixed: bug#17746 - control chars are now filtered within "to" and "subject" parameters Index: php4/ext/standard/mail.c diff -u php4/ext/standard/mail.c:1.53 php4/ext/standard/mail.c:1.54 --- php4/ext/standard/mail.c:1.53 Mon Jun 10 08:24:15 2002 +++ php4/ext/standard/mail.c Thu Jun 13 14:54:45 2002 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: mail.c,v 1.53 2002/06/10 12:24:15 mfischer Exp $ */ +/* $Id: mail.c,v 1.54 2002/06/13 18:54:45 sesser Exp $ */ #include <stdlib.h> #include <ctype.h> @@ -70,7 +70,7 @@ PHP_FUNCTION(mail) { char *to=NULL, *message=NULL, *headers=NULL, *subject=NULL, *extra_cmd=NULL; - int to_len,message_len,headers_len,subject_len,extra_cmd_len; + int to_len,message_len,headers_len,subject_len,extra_cmd_len,i; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sss|ss", @@ -83,14 +83,22 @@ return; } - for(to_len--;to_len;to_len--) { - if(!isspace(to[to_len]))break; - to[to_len]='\0'; + if (to_len > 0) { + for(to_len--;to_len;to_len--) { + if(!isspace((unsigned char)to[to_len]))break; + to[to_len]='\0'; + } + for(i=0;!iscntrl((unsigned char)to[i]);i++) {} + to[i]='\0'; } - for(subject_len--;subject_len;subject_len--) { - if(!isspace(subject[subject_len]))break; - subject[subject_len]='\0'; + if (subject_len > 0) { + for(subject_len--;subject_len;subject_len--) { + if(!isspace((unsigned char)subject[subject_len]))break; + subject[subject_len]='\0'; + } + for(i=0;!iscntrl((unsigned char)subject[i]);i++) {} + subject[i]='\0'; } if(extra_cmd)