diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2007-03-30 00:28:58 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2007-03-30 00:28:58 +0000 |
| commit | 86ca439a5d27249f4190daef40a9de029de8a159 (patch) | |
| tree | bd7885825facb14570fa58080a23ce54271b8bbf /ext/standard/mail.c | |
| parent | 52b07d18956e8bbe9bdf0494dcf32b99edc3bac4 (diff) | |
| download | php-git-86ca439a5d27249f4190daef40a9de029de8a159.tar.gz | |
Fixed MOPB-34-2007:PHP mail() Header Injection Through Subject and To
Parameters
Diffstat (limited to 'ext/standard/mail.c')
| -rw-r--r-- | ext/standard/mail.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ext/standard/mail.c b/ext/standard/mail.c index 6c5f3ec9cf..08f0a121c7 100644 --- a/ext/standard/mail.c +++ b/ext/standard/mail.c @@ -48,8 +48,8 @@ #define SKIP_LONG_HEADER_SEP(str, pos) \ if (str[pos] == '\r' && str[pos + 1] == '\n' && (str[pos + 2] == ' ' || str[pos + 2] == '\t')) { \ - pos += 3; \ - while (str[pos] == ' ' || str[pos] == '\t') { \ + pos += 2; \ + while (str[pos + 1] == ' ' || str[pos + 1] == '\t') { \ pos++; \ } \ continue; \ |