1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
|
diff -Nurp orig/ext/imap/php_imap.c new/ext/imap/php_imap.c
--- orig/ext/imap/php_imap.c 2007-02-21 08:35:44.000000000 +0100
+++ new/ext/imap/php_imap.c 2007-02-21 08:37:15.000000000 +0100
@@ -62,6 +62,9 @@
#define CRLF_LEN sizeof("\015\012") - 1
#define PHP_EXPUNGE 32768
#define PHP_IMAP_ADDRESS_SIZE_BUF 10
+#ifndef SENDBUFLEN
+#define SENDBUFLEN 16385
+#endif
static void _php_make_header_object(zval *myzvalue, ENVELOPE *en TSRMLS_DC);
static void _php_imap_add_body(zval *arg, BODY *body TSRMLS_DC);
@@ -1152,13 +1152,13 @@ PHP_FUNCTION(imap_headers)
if ((i = cache->user_flags)) {
strcat(tmp, "{");
while (i) {
- strcat(tmp, imap_le_struct->imap_stream->user_flags[find_rightmost_bit (&i)]);
- if (i) strcat(tmp, " ");
+ strlcat(tmp, imap_le_struct->imap_stream->user_flags[find_rightmost_bit (&i)], sizeof(tmp));
+ if (i) strlcat(tmp, " ", sizeof(tmp));
}
- strcat(tmp, "} ");
+ strlcat(tmp, "} ", sizeof(tmp));
}
mail_fetchsubject(t = tmp + strlen(tmp), imap_le_struct->imap_stream, msgno, (long)25);
- sprintf(t += strlen(t), " (%ld chars)", cache->rfc822_size);
+ snprintf(t += strlen(t), sizeof(tmp) - strlen(tmp), " (%ld chars)", cache->rfc822_size);
add_next_index_string(return_value, tmp, 1);
}
}
@@ -2915,7 +2915,7 @@ PHP_FUNCTION(imap_mail_compose)
BODY *bod=NULL, *topbod=NULL;
PART *mypart=NULL, *part;
PARAMETER *param, *disp_param = NULL, *custom_headers_param = NULL, *tmp_param = NULL;
- char tmp[8 * MAILTMPLEN], *mystring=NULL, *t=NULL, *tempstring=NULL;
+ char tmp[SENDBUFLEN + 1], *mystring=NULL, *t=NULL, *tempstring=NULL;
int toppart = 0;
if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &envelope, &body) == FAILURE) {
@@ -3216,8 +3216,8 @@ PHP_FUNCTION(imap_mail_compose)
goto done;
}
- rfc822_encode_body_7bit(env, topbod);
- rfc822_header (tmp, env, topbod);
+ rfc822_encode_body_7bit(env, topbod);
+ rfc822_header(tmp, env, topbod);
/* add custom envelope headers */
if (custom_headers_param) {
@@ -3266,43 +3266,42 @@ PHP_FUNCTION(imap_mail_compose)
/* yucky default */
if (!cookie) {
cookie = "-";
+ } else if (strlen(cookie) > (sizeof(tmp) - 2 - 2)) { /* validate cookie length -- + CRLF */
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "The boudary should be no longer then 4kb");
+ RETVAL_FALSE;
+ goto done;
}
/* for each part */
do {
t=tmp;
/* build cookie */
- sprintf (t, "--%s%s", cookie, CRLF);
+ sprintf(t, "--%s%s", cookie, CRLF);
/* append mini-header */
rfc822_write_body_header(&t, &part->body);
/* write terminating blank line */
- strcat (t, CRLF);
+ strcat(t, CRLF);
/* output cookie, mini-header, and contents */
- tempstring=emalloc(strlen(mystring)+strlen(tmp)+1);
- sprintf(tempstring, "%s%s", mystring, tmp);
+ spprintf(&tempstring, 0, "%s%s", mystring, tmp);
efree(mystring);
mystring=tempstring;
bod=&part->body;
- tempstring=emalloc(strlen(bod->contents.text.data)+strlen(CRLF)+strlen(mystring)+1);
- sprintf(tempstring, "%s%s%s", mystring, bod->contents.text.data, CRLF);
+ spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data, CRLF);
efree(mystring);
mystring=tempstring;
} while ((part = part->next)); /* until done */
/* output trailing cookie */
- sprintf(tmp, "--%s--", cookie);
- tempstring=emalloc(strlen(tmp)+strlen(CRLF)+strlen(mystring)+1);
- sprintf(tempstring, "%s%s%s", mystring, tmp, CRLF);
+ spprintf(&tempstring, 0, "%s--%s--%s", mystring, tmp, CRLF);
efree(mystring);
mystring=tempstring;
} else if (bod) {
- tempstring = emalloc(strlen(bod->contents.text.data)+strlen(CRLF)+strlen(mystring)+1);
- sprintf(tempstring, "%s%s%s", mystring, bod->contents.text.data, CRLF);
+ spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data, CRLF);
efree(mystring);
mystring=tempstring;
} else {
@@ -3350,14 +3349,14 @@ int _php_imap_mail(char *to, char *subje
#define PHP_IMAP_CLEAN if (bufferTo) efree(bufferTo); if (bufferCc) efree(bufferCc); if (bufferBcc) efree(bufferBcc); if (bufferHeader) efree(bufferHeader);
#define PHP_IMAP_BAD_DEST PHP_IMAP_CLEAN; efree(tempMailTo); return (BAD_MSG_DESTINATION);
- bufferHeader = (char *)emalloc(bufferLen);
+ bufferHeader = (char *)emalloc(bufferLen + 1);
memset(bufferHeader, 0, bufferLen);
if (to && *to) {
- strcat(bufferHeader, "To: ");
- strcat(bufferHeader, to);
- strcat(bufferHeader, "\r\n");
+ strlcat(bufferHeader, "To: ", bufferLen + 1);
+ strlcat(bufferHeader, to, bufferLen + 1);
+ strlcat(bufferHeader, "\r\n", bufferLen + 1);
tempMailTo = estrdup(to);
- bufferTo = (char *)emalloc(strlen(to));
+ bufferTo = (char *)emalloc(strlen(to) + 1);
offset = 0;
addr = NULL;
rfc822_parse_adrlist(&addr, tempMailTo, NULL);
@@ -3376,11 +3375,11 @@ int _php_imap_mail(char *to, char *subje
}
if (cc && *cc) {
- strcat(bufferHeader, "Cc: ");
- strcat(bufferHeader, cc);
- strcat(bufferHeader, "\r\n");
+ strlcat(bufferHeader, "Cc: ", bufferLen + 1);
+ strlcat(bufferHeader, cc, bufferLen + 1);
+ strlcat(bufferHeader, "\r\n", bufferLen + 1);
tempMailTo = estrdup(cc);
- bufferCc = (char *)emalloc(strlen(cc));
+ bufferCc = (char *)emalloc(strlen(cc) + 1);
offset = 0;
addr = NULL;
rfc822_parse_adrlist(&addr, tempMailTo, NULL);
@@ -3400,7 +3399,7 @@ int _php_imap_mail(char *to, char *subje
if (bcc && *bcc) {
tempMailTo = estrdup(bcc);
- bufferBcc = (char *)emalloc(strlen(bcc));
+ bufferBcc = (char *)emalloc(strlen(bcc) + 1);
offset = 0;
addr = NULL;
rfc822_parse_adrlist(&addr, tempMailTo, NULL);
@@ -3419,7 +3418,7 @@ int _php_imap_mail(char *to, char *subje
}
if (headers && *headers) {
- strcat(bufferHeader, headers);
+ strlcat(bufferHeader, headers, bufferLen + 1);
}
if (TSendMail(INI_STR("SMTP"), &tsm_err, &tsm_errmsg, bufferHeader, subject, bufferTo, message, bufferCc, bufferBcc, rpath TSRMLS_CC) != SUCCESS) {
|
