File php-4.3.9-CVE-2007-0906-imap.patch of Package php4

File php-4.3.9-CVE-2007-0906-imap.patch of Package php4 (Revision 832258cdd44878b64f0e28a2efd888d8)

Currently displaying revision 832258cdd44878b64f0e28a2efd888d8, show latest

--- php-4.3.9/ext/imap/php_imap.c.cve0906-imap
+++ php-4.3.9/ext/imap/php_imap.c
@@ -60,6 +60,9 @@
 #define CRLF	"\015\012"
 #define PHP_EXPUNGE 32768
 #define PHP_IMAP_ADDRESS_SIZE_BUF 10
+#ifndef SENDBUFLEN
+#define SENDBUFLEN 16385
+#endif
 
 static void _php_make_header_object(zval *myzvalue, ENVELOPE *en TSRMLS_DC);
 static void _php_imap_add_body(zval *arg, BODY *body TSRMLS_DC);
@@ -2789,7 +2792,7 @@
 	BODY *bod=NULL, *topbod=NULL;
 	PART *mypart=NULL, *toppart=NULL, *part;
 	PARAMETER *param, *disp_param = NULL, *custom_headers_param = NULL, *tmp_param = NULL;
-	char tmp[8 * MAILTMPLEN], *mystring=NULL, *t=NULL, *tempstring=NULL;
+	char tmp[SENDBUFLEN + 1], *mystring=NULL, *t=NULL, *tempstring=NULL;
 
 	if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &envelope, &body) == FAILURE) {
 		ZEND_WRONG_PARAM_COUNT();
@@ -3109,6 +3112,10 @@
 		/* yucky default */
 			if (!cookie) {
 				cookie = "-";  
+			} else if (strlen(cookie) > (sizeof(tmp) - 2 - 2)) {  /* validate cookie length -- + CRLF */
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "The boundary should be no longer then 4kb");
+				RETVAL_FALSE;
+				return;	
 			}
 
 		/* for each part */