Re: The case of HTTP response splitting protection in PHP
| From: | Gustavo Lopes | Date: | Fri, 03 Feb 2012 14:16:31 +0000 |
| Subject: | Re: The case of HTTP response splitting protection in PHP | ||
| References: | 1 2 3 4 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-57662@lists.php.net to get a copy of this message | ||
On Fri, 03 Feb 2012 15:13:56 +0100, John LeSueur <john.lesueur@gmail.com> wrote:
I could be wrong, but doesn't: (header_line[i+1] != ' ' && header_line[i+1] != '\t') access an element past the end of the header_line array on the last iteration of the for loop? shouldn't the for loop go until header_line_len - 1?No in this case because header_line_len is the length not including the terminator and estrndup guarantees a null terminated string. Thanks -- Gustavo Lopes