diff options
| author | Ferenc Kovacs <tyrael@php.net> | 2015-06-10 10:49:51 +0200 |
|---|---|---|
| committer | Ferenc Kovacs <tyrael@php.net> | 2015-06-10 10:49:51 +0200 |
| commit | dbf30365aa15b9044d75b8f77db570bf8fdf2726 (patch) | |
| tree | e0b4481c39b2852b91037b38fa0ee5ec3776b52b /ext/standard/mail.c | |
| parent | 9cb8cb47975b044bbaafd2d12287ff52cdd3b0e9 (diff) | |
| parent | 5ff259ebb72c1f5cef45c235ca1a85b8e1523835 (diff) | |
| download | php-git-php-7.0.0alpha1.tar.gz | |
Merge remote-tracking branch 'origin/master' into PHP-7.0.0php-7.0.0alpha1
* origin/master:
add missing NEWS entries
add missing NEWS entries
Fixed bug #69646 (OS command injection vulnerability in escapeshellarg)
add NEWS
Fixed bug #68776
fix test
update NEWS
fix typo
Fix bug #69646 OS command injection vulnerability in escapeshellarg
Fix #69719 - more checks for nulls in paths
fix test description
Fixed Buf #68812 Unchecked return value.
Diffstat (limited to 'ext/standard/mail.c')
| -rw-r--r-- | ext/standard/mail.c | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/ext/standard/mail.c b/ext/standard/mail.c index 5633372022..a9046cea69 100644 --- a/ext/standard/mail.c +++ b/ext/standard/mail.c @@ -224,6 +224,44 @@ void php_mail_log_to_file(char *filename, char *message, size_t message_size) { } +static int php_mail_detect_multiple_crlf(char *hdr) { + /* This function detects multiple/malformed multiple newlines. */ + size_t len; + + if (!hdr) { + return 0; + } + + /* Should not have any newlines at the beginning. */ + /* RFC 2822 2.2. Header Fields */ + if (*hdr < 33 || *hdr > 126 || *hdr == ':') { + return 1; + } + + while(*hdr) { + if (*hdr == '\r') { + if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || (*(hdr+1) == '\n' && (*(hdr+2) == '\0' || *(hdr+2) == '\n' || *(hdr+2) == '\r'))) { + /* Malformed or multiple newlines. */ + return 1; + } else { + hdr += 2; + } + } else if (*hdr == '\n') { + if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || *(hdr+1) == '\n') { + /* Malformed or multiple newlines. */ + return 1; + } else { + hdr += 2; + } + } else { + hdr++; + } + } + + return 0; +} + + /* {{{ php_mail */ PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char *extra_cmd) @@ -278,6 +316,7 @@ PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char efree(tmp); } + if (PG(mail_x_header)) { const char *tmp = zend_get_executed_filename(); zend_string *f; @@ -292,6 +331,11 @@ PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char zend_string_release(f); } + if (hdr && php_mail_detect_multiple_crlf(hdr)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Multiple or malformed newlines found in additional_header"); + MAIL_RET(0); + } + if (!sendmail_path) { #if (defined PHP_WIN32 || defined NETWARE) /* handle old style win smtp sending */ |