Overwrite control chars in parameters with whitespace instead of truncating.

1 files changed, 16 insertions, 10 deletions

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index 6da774523d..6e3fd4a277 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -88,21 +88,27 @@ PHP_FUNCTION(mail)
 	}
 
 	if (to_len > 0) {
-		for(to_len--;to_len;to_len--) {
-			if(!isspace((unsigned char)to[to_len]))break;
-			to[to_len]='\0';
+		for(;to_len;to_len--) {
+			if(!isspace((unsigned char)to[to_len-1]))break;
+			to[to_len-1]='\0';
+		}
+		for(i=0;to[i];i++) {
+			if (iscntrl((unsigned char)to[i])) {
+				to[i]=' ';
+			}
 		}
-		for(i=0;!iscntrl((unsigned char)to[i]);i++) {}
-		to[i]='\0';
 	}
 
 	if (subject_len > 0) {
-		for(subject_len--;subject_len;subject_len--) {
-			if(!isspace((unsigned char)subject[subject_len]))break;
-			subject[subject_len]='\0';
+		for(;subject_len;subject_len--) {
+			if(!isspace((unsigned char)subject[subject_len-1]))break;
+			subject[subject_len-1]='\0';
+		}
+		for(i=0;subject[i];i++) {
+			if (iscntrl((unsigned char)subject[i])) {
+				subject[i]=' ';
+			}
 		}
-		for(i=0;!iscntrl((unsigned char)subject[i]);i++) {}
-		subject[i]='\0';
 	}
 
 	if(extra_cmd)