Description:
------------
Hi,

In /ext/mbstring/mbstring.c:

3891        int state = 0;
3892        int crlf_state = -1;
3893        char *token;
[..]
3897        ps = str;
3898        icnt = str_len;


3912        while (icnt > 0) {
3913                switch (*ps) {
3914                        case ':':
3915                                if (crlf_state == 1) {
3916                                        token_pos++;
3917                                }
3918
3919                                if (state == 0 || state == 1) {
3920                                        fld_name = zend_string_init(token, token_pos, 0);


zend_string_init() is:


Zend/zend_string.h
131static zend_always_inline zend_string *zend_string_init(const char *str, size_t len, int persistent)
132{
133        zend_string *ret = zend_string_alloc(len, persistent);
134
135        memcpy(ret->val, str, len);
136        ret->val[len] = '\0';
137        return ret;
138}

so a null pointer is passed to memcpy on the src variable.


A quick look shows that a testcase could be made if the 'str' in _php_mbstr_parse_mail_headers() is passed with ':'.