Bug #14983: mail function buffer overflow
| From: | enricod at videotron dot ca | Date: | Thu, 10 Jan 2002 23:56:46 +0000 |
| Subject: | Bug #14983: mail function buffer overflow | ||
| Groups: | php.dev | ||
| Request: | Send a blank email to php-dev+get-76552@lists.php.net to get a copy of this message | ||
From: enricod@videotron.ca
Operating system: Windows 2000
PHP version: 4.1.1
PHP Bug Type: Reproducible crash
Bug description: mail function buffer overflow
from win32\sendmail.h :
#define MAIL_BUFFER_SIZE (1024*4) /* 4k buffer */
sendmail.c uses sprintf's to this buffer without range checking resulting
in a crash of php in most of the cases when the "extra headers" surpass
4k.
Im working on a fixed version of sendmail.c if your interested.
ciao,
Enrico
--
Edit bug report at: http://bugs.php.net/?id=14983&edit=1