php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #80201 incomplete header returned
Submitted: 2020-10-07 18:41 UTC Modified: 2020-10-19 08:09 UTC
Votes:3
Avg. Score:4.0 ± 0.8
Reproduced:3 of 3 (100.0%)
Same Version:2 (66.7%)
Same OS:3 (100.0%)
From: smile dot 80 at bk dot ru Assigned:
Status: Analyzed Package: IMAP related
PHP Version: 7.4.11 OS: linux/windows
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2020-10-07 18:41 UTC] smile dot 80 at bk dot ru
Description:
------------
---
From manual page: https://php.net/function.imap-fetchheader
---


It is difficult to describe the error.
The letter header contains the # 00 symbol in the header value. It is included in the ASCII table and does not contradict RFC 2822.

Imap_fetchheader returns all headers up to # 00.

For example heading:
Message-Id: <20201007090331 .3VdeNwPA @ mxfront10o.mail.yandex.net>

Where after ..0331 (# 00)

The function will return (string) "Message-Id: <20201007090331"


Test script:
---------------
imap_fetchheader ( $imap_stream , $$msg_number );



Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2020-10-19 08:09 UTC] cmb@php.net
-Status: Open +Status: Analyzed
 [2020-10-19 08:09 UTC] cmb@php.net
Form the mail_fetchheader_full() documentation:

| If the len argument is non-NIL, it holds a pointer in which the
| length of the string in octets is returned.  This is useful in
| cases where there may be an embedded null in the string.

We do pass NIL to mail_fetchheader_full(), though, and as such
imap_fetchheader() truncates the string.  The fix is trivial, but
while investigating further I found bug #80203, and it seems to me
there are more cases where the IMAP extension does not properly
handle NUL bytes.
 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Wed Oct 27 04:03:38 2021 UTC