[pecl-mail-mailparse] master: Fix out-of-bounds token read on trailing address delimiters

Author: Ilia Alshanetsky (iliaal) Committer: Remi Collet (remicollet) Date: 2026-06-18T08:40:51+02:00 Commit: https://github.com/php/pecl-mail-mailparse/commit/b28ae66561bcdc330e2c741d545560b7d499aff6 Raw diff: https://github.com/php/pecl-mail-mailparse/commit/b28ae66561bcdc330e2c741d545560b7d499aff6.diff Fix out-of-bounds token read on trailing address delimiters When the delimiter-skip loop in parse_address_tokens() advances start_tok to exactly toks->ntokens (an address followed by one or more trailing ',' or ';'), the addr-spec branch read toks->tokens[start_tok].token with start_tok == ntokens, one element past the ecalloc'd token array. mailparse_rfc822_parse_addresses("a@b,,") triggers it. Only strip the enclosing <> when the address span is non-empty (a_count > 0), which also guarantees a_start < ntokens. The route-addr branch is already guarded by its i < ntokens entry condition. Change applied to both the .re source and the generated .c. Changed paths: A tests/addr_trailing_delim_oob.phpt M package.xml M php_mailparse_rfc822.c M php_mailparse_rfc822.re Diff: diff --git a/package.xml b/package.xml index 7cae640..6060137 100644 --- a/package.xml +++ b/package.xml @@ -83,6 +83,7 @@ It can deal with rfc822 and rfc2045 (MIME) compliant messages. <file name="012-stream.phpt" role="test" /> <file name="012-var.phpt" role="test" /> <file name="013.phpt" role="test" /> + <file name="addr_trailing_delim_oob.phpt" role="test" /> <file name="bug001.phpt" role="test" /> <file name="bug73110.phpt" role="test" /> <file name="bug74223.phpt" role="test" /> diff --git a/php_mailparse_rfc822.c b/php_mailparse_rfc822.c index 28a001a..c66d802 100644 --- a/php_mailparse_rfc822.c +++ b/php_mailparse_rfc822.c @@ -1,4 +1,4 @@ -/* Generated by re2c 3.1 on Wed Jul 30 12:30:59 2025 */ +/* Generated by re2c 3.1 on Thu Jun 18 08:39:03 2026 */ #line 1 "/home/php/git/mailparse/php_mailparse_rfc822.re" /* +----------------------------------------------------------------------+ @@ -547,7 +547,7 @@ static void parse_address_tokens(php_rfc822_tokenized_t *toks, a_count = i - start_tok; /* if an address is enclosed in <>, leave them out of the the * address value that we return */ - if (toks->tokens[a_start].token == '<') { + if (a_count > 0 && toks->tokens[a_start].token == '<') { a_start++; a_count--; } diff --git a/php_mailparse_rfc822.re b/php_mailparse_rfc822.re index 98699ac..c22dabb 100644 --- a/php_mailparse_rfc822.re +++ b/php_mailparse_rfc822.re @@ -410,7 +410,7 @@ mailbox: /* addr-spec / phrase route-addr */ a_count = i - start_tok; /* if an address is enclosed in <>, leave them out of the the * address value that we return */ - if (toks->tokens[a_start].token == '<') { + if (a_count > 0 && toks->tokens[a_start].token == '<') { a_start++; a_count--; } diff --git a/tests/addr_trailing_delim_oob.phpt b/tests/addr_trailing_delim_oob.phpt new file mode 100644 index 0000000..1502ac0 --- /dev/null +++ b/tests/addr_trailing_delim_oob.phpt @@ -0,0 +1,16 @@ +--TEST-- +Trailing delimiters in an address list do not read past the token array +--SKIPIF-- +<?php if (!extension_loaded("mailparse")) print "skip"; ?> +--FILE-- +<?php +$r = mailparse_rfc822_parse_addresses("a@b,,"); +var_dump($r[0]['address']); +$r = mailparse_rfc822_parse_addresses("grp: a@b,,"); +var_dump($r[0]['is_group']); +echo "done\n"; +?> +--EXPECT-- +string(3) "a@b" +bool(true) +done