cvs: php-src(PHP_4_4) / NEWS /ext/standard mail.c

iliaa Tue Mar 27 00:14:17 2007 UTC Modified files: (Branch: PHP_4_4) /php-src/ext/standard mail.c /php-src NEWS Log: MFB: MOPB-33-2007:PHP mail() Message ASCIIZ Byte Truncation http://cvs.php.net/viewvc.cgi/php-src/ext/standard/mail.c?r1=1.66.2.12.4.3&r2=1.66.2.12.4.4&diff_format=u Index: php-src/ext/standard/mail.c diff -u php-src/ext/standard/mail.c:1.66.2.12.4.3 php-src/ext/standard/mail.c:1.66.2.12.4.4 --- php-src/ext/standard/mail.c:1.66.2.12.4.3 Mon Jan 1 09:46:48 2007 +++ php-src/ext/standard/mail.c Tue Mar 27 00:14:16 2007 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: mail.c,v 1.66.2.12.4.3 2007/01/01 09:46:48 sebastian Exp $ */ +/* $Id: mail.c,v 1.66.2.12.4.4 2007/03/27 00:14:16 iliaa Exp $ */ #include <stdlib.h> #include <ctype.h> @@ -55,6 +55,14 @@ continue; \ } \ +#define MAIL_ASCIIZ_CHECK(str, len) \ + p = str; \ + e = p + len; \ + while (p = memchr(p, '\0', (e - p))) { \ + *p = ' '; \ + } \ + + /* {{{ proto int ezmlm_hash(string addr) Calculate EZMLM list hash value. */ PHP_FUNCTION(ezmlm_hash) @@ -87,6 +95,7 @@ int to_len, message_len, headers_len; int subject_len, extra_cmd_len, i; char *to_r, *subject_r; + char *p, *e; if (PG(safe_mode) && (ZEND_NUM_ARGS() == 5)) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "SAFE MODE Restriction in effect. The fifth parameter is disabled in SAFE MODE."); @@ -103,6 +112,17 @@ return; } + /* ASCIIZ check */ + MAIL_ASCIIZ_CHECK(to, to_len); + MAIL_ASCIIZ_CHECK(subject, subject_len); + MAIL_ASCIIZ_CHECK(message, message_len); + if (headers) { + MAIL_ASCIIZ_CHECK(headers, headers_len); + } + if (extra_cmd) { + MAIL_ASCIIZ_CHECK(extra_cmd, extra_cmd_len); + } + if (to_len > 0) { to_r = estrndup(to, to_len); for (; to_len; to_len--) { @@ -147,7 +167,7 @@ if (extra_cmd) { extra_cmd = php_escape_shell_cmd(extra_cmd); } - + if (php_mail(to_r, subject_r, message, headers, extra_cmd TSRMLS_CC)) { RETVAL_TRUE; } else { http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.1247.2.920.2.217&r2=1.1247.2.920.2.218&diff_format=u Index: php-src/NEWS diff -u php-src/NEWS:1.1247.2.920.2.217 php-src/NEWS:1.1247.2.920.2.218 --- php-src/NEWS:1.1247.2.920.2.217 Mon Mar 26 11:19:37 2007 +++ php-src/NEWS Tue Mar 27 00:14:16 2007 @@ -1,6 +1,7 @@ PHP 4 NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2007, Version 4.4.7 +- Fixed MOPB-33-2007 PHP mail() Message ASCIIZ Byte Truncation. (Ilia) - Fixed CRLF injection inside ftp_putcmd(). (Ilia) - Fixed MOPB-32-2007 (Double free inside session_decode()). (Ilia) - Fixed MOPB-21-2007 An open_basedir/safe_mode bypass inside the