Skip to content

Commit f33fd9b

Browse files
committed
Throw ValueError on null bytes in mb_send_mail()
Instead of silently replacing with spaces.
1 parent 9e3e834 commit f33fd9b

File tree

2 files changed

+48
-26
lines changed

2 files changed

+48
-26
lines changed

ext/mbstring/mbstring.c

Lines changed: 10 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -3268,13 +3268,6 @@ PHP_FUNCTION(mb_decode_numericentity)
32683268
continue; \
32693269
}
32703270

3271-
#define MAIL_ASCIIZ_CHECK_MBSTRING(str, len) \
3272-
pp = str; \
3273-
ee = pp + len; \
3274-
while ((pp = memchr(pp, '\0', (ee - pp)))) { \
3275-
*pp = ' '; \
3276-
} \
3277-
32783271
static int _php_mbstr_parse_mail_headers(HashTable *ht, const char *str, size_t str_len)
32793272
{
32803273
const char *ps;
@@ -3451,7 +3444,7 @@ PHP_FUNCTION(mb_send_mail)
34513444
size_t subject_len;
34523445
zend_string *extra_cmd = NULL;
34533446
HashTable *headers_ht = NULL;
3454-
zend_string *str_headers = NULL, *tmp_headers;
3447+
zend_string *str_headers = NULL;
34553448
size_t n, i;
34563449
char *to_r = NULL;
34573450
char *force_extra_parameters = INI_STR("mail.force_extra_parameters");
@@ -3473,7 +3466,6 @@ PHP_FUNCTION(mb_send_mail)
34733466
HashTable ht_headers;
34743467
zval *s;
34753468
extern void mbfl_memory_device_unput(mbfl_memory_device *device);
3476-
char *pp, *ee;
34773469

34783470
/* initialize */
34793471
mbfl_memory_device_init(&device, 0, 0);
@@ -3492,32 +3484,24 @@ PHP_FUNCTION(mb_send_mail)
34923484
}
34933485

34943486
ZEND_PARSE_PARAMETERS_START(3, 5)
3495-
Z_PARAM_STRING(to, to_len)
3496-
Z_PARAM_STRING(subject, subject_len)
3497-
Z_PARAM_STRING(message, message_len)
3487+
Z_PARAM_PATH(to, to_len)
3488+
Z_PARAM_PATH(subject, subject_len)
3489+
Z_PARAM_PATH(message, message_len)
34983490
Z_PARAM_OPTIONAL
34993491
Z_PARAM_STR_OR_ARRAY_HT_OR_NULL(str_headers, headers_ht)
3500-
Z_PARAM_STR_OR_NULL(extra_cmd)
3492+
Z_PARAM_PATH_STR_OR_NULL(extra_cmd)
35013493
ZEND_PARSE_PARAMETERS_END();
35023494

3503-
/* ASCIIZ check */
3504-
MAIL_ASCIIZ_CHECK_MBSTRING(to, to_len);
3505-
MAIL_ASCIIZ_CHECK_MBSTRING(subject, subject_len);
3506-
MAIL_ASCIIZ_CHECK_MBSTRING(message, message_len);
3507-
35083495
if (str_headers) {
3509-
tmp_headers = zend_string_init(ZSTR_VAL(str_headers), ZSTR_LEN(str_headers), 0);
3510-
MAIL_ASCIIZ_CHECK_MBSTRING(ZSTR_VAL(tmp_headers), ZSTR_LEN(tmp_headers));
3511-
str_headers = php_trim(tmp_headers, NULL, 0, 2);
3512-
zend_string_release_ex(tmp_headers, 0);
3496+
if (strlen(ZSTR_VAL(str_headers)) != ZSTR_LEN(str_headers)) {
3497+
zend_argument_value_error(4, "must not contain any null bytes");
3498+
RETURN_THROWS();
3499+
}
3500+
str_headers = php_trim(str_headers, NULL, 0, 2);
35133501
} else if (headers_ht) {
35143502
str_headers = php_mail_build_headers(headers_ht);
35153503
}
35163504

3517-
if (extra_cmd) {
3518-
MAIL_ASCIIZ_CHECK_MBSTRING(ZSTR_VAL(extra_cmd), ZSTR_LEN(extra_cmd));
3519-
}
3520-
35213505
zend_hash_init(&ht_headers, 0, NULL, ZVAL_PTR_DTOR, 0);
35223506

35233507
if (str_headers != NULL) {
Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
mb_send_mail() with null bytes in arguments
3+
--FILE--
4+
<?php
5+
6+
try {
7+
mb_send_mail("foo\0bar", "x", "y");
8+
} catch (ValueError $e) {
9+
echo $e->getMessage(), "\n";
10+
}
11+
try {
12+
mb_send_mail("x", "foo\0bar", "y");
13+
} catch (ValueError $e) {
14+
echo $e->getMessage(), "\n";
15+
}
16+
try {
17+
mb_send_mail("x", "y", "foo\0bar");
18+
} catch (ValueError $e) {
19+
echo $e->getMessage(), "\n";
20+
}
21+
try {
22+
mb_send_mail("x", "y", "z", "foo\0bar");
23+
} catch (ValueError $e) {
24+
echo $e->getMessage(), "\n";
25+
}
26+
try {
27+
mb_send_mail("x", "y", "z", "q", "foo\0bar");
28+
} catch (ValueError $e) {
29+
echo $e->getMessage(), "\n";
30+
}
31+
32+
?>
33+
--EXPECT--
34+
mb_send_mail(): Argument #1 ($to) must not contain any null bytes
35+
mb_send_mail(): Argument #2 ($subject) must not contain any null bytes
36+
mb_send_mail(): Argument #3 ($message) must not contain any null bytes
37+
mb_send_mail(): Argument #4 ($additional_headers) must not contain any null bytes
38+
mb_send_mail(): Argument #5 ($additional_parameters) must not contain any null bytes

0 commit comments

Comments
 (0)