Re: cvs: php-src(PHP_5_2) /ext/imap php_imap.c

Hi Ilia My c-client library (2004g) from BSD ports doesn't have SENDBUFLEN defined... -Hannes On 12/24/06, Ilia Alshanetsky <iliaa@php.net> wrote:

iliaa           Sun Dec 24 22:15:07 2006 UTC

  Modified files:              (Branch: PHP_5_2)
    /php-src/ext/imap   php_imap.c

Log: Fixed buffer boundary protection http://cvs.php.net/viewvc.cgi/php-src/ext/imap/php_imap.c?r1=1.208.2.7.2.11&r2=1.208.2.7.2.12&diff_format=u Index: php-src/ext/imap/php_imap.c diff -u php-src/ext/imap/php_imap.c:1.208.2.7.2.11 php-src/ext/imap/php_imap.c:1.208.2.7.2.12 --- php-src/ext/imap/php_imap.c:1.208.2.7.2.11 Sun Dec 17 18:22:53 2006 +++ php-src/ext/imap/php_imap.c Sun Dec 24 22:15:06 2006 @@ -26,7 +26,7 @@

    | PHP 4.0 updates:  Zeev Suraski <zeev@zend.com>                       |
    +----------------------------------------------------------------------+

*/ -/* $Id: php_imap.c,v 1.208.2.7.2.11 2006/12/17 18:22:53 iliaa Exp $ */ +/* $Id: php_imap.c,v 1.208.2.7.2.12 2006/12/24 22:15:06 iliaa Exp $ */ #define IMAP41 @@ -2950,7 +2950,7 @@

        BODY *bod=NULL, *topbod=NULL;
        PART *mypart=NULL, *part;
        PARAMETER *param, *disp_param = NULL, *custom_headers_param = NULL, *tmp_param = NULL;
-       char tmp[8 * MAILTMPLEN], *mystring=NULL, *t=NULL, *tempstring=NULL;
+       char tmp[SENDBUFLEN + 1], *mystring=NULL, *t=NULL, *tempstring=NULL;
        int toppart = 0;

        if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &envelope, &body) == FAILURE) {

@@ -3251,8 +3251,8 @@

                goto done;
        }

-       rfc822_encode_body_7bit(env, topbod);
-       rfc822_header (tmp, env, topbod);
+       rfc822_encode_body_7bit(env, topbod);
+       rfc822_header(tmp, env, topbod);

        /* add custom envelope headers */
        if (custom_headers_param) {

@@ -3301,43 +3301,42 @@

                /* yucky default */
                        if (!cookie) {
                                cookie = "-";
+                       } else if (strlen(cookie) > (sizeof(tmp) - 2 - 2)) {  /* validate cookie length -- + CRLF */
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "The boudary should be no longer then 4kb");
+                               RETVAL_FALSE;
+                               goto done;
                        }

                /* for each part */
                        do {
                                t=tmp;
                        /* build cookie */
-                               sprintf (t, "--%s%s", cookie, CRLF);
+                               sprintf(t, "--%s%s", cookie, CRLF);

                        /* append mini-header */
                                rfc822_write_body_header(&t, &part->body);

                        /* write terminating blank line */
-                               strcat (t, CRLF);
+                               strcat(t, CRLF);

                        /* output cookie, mini-header, and contents */
-                               tempstring=emalloc(strlen(mystring)+strlen(tmp)+1);
-                               sprintf(tempstring, "%s%s", mystring, tmp);
+                               spprintf(&tempstring, 0, "%s%s", mystring, tmp);
                                efree(mystring);
                                mystring=tempstring;

                                bod=&part->body;

-                               tempstring=emalloc(strlen(bod->contents.text.data)+strlen(CRLF)+strlen(mystring)+1);
-                               sprintf(tempstring, "%s%s%s", mystring, bod->contents.text.data, CRLF);
+                               spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data, CRLF);
                                efree(mystring);
                                mystring=tempstring;
                        } while ((part = part->next)); /* until done */

                        /* output trailing cookie */
-                       sprintf(tmp, "--%s--", cookie);
-                       tempstring=emalloc(strlen(tmp)+strlen(CRLF)+strlen(mystring)+1);
-                       sprintf(tempstring, "%s%s%s", mystring, tmp, CRLF);
+                       spprintf(&tempstring, 0, "%s--%s--%s", mystring, tmp, CRLF);
                        efree(mystring);
                        mystring=tempstring;
        } else if (bod) {
-                       tempstring = emalloc(strlen(bod->contents.text.data)+strlen(CRLF)+strlen(mystring)+1);
-                       sprintf(tempstring, "%s%s%s", mystring, bod->contents.text.data, CRLF);
+                       spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data, CRLF);
                        efree(mystring);
                        mystring=tempstring;
        } else {

-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php