php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

ext/standard: Fix memory leak in mail() when header key is numeric

Browse Source 
Closes GH-20776
This commit is contained in:
Gina Peter Banyard
2025-12-24 17:48:18 +01:00
parent 5faa54d93b
commit 20f9772063
3 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@@ -57,6 +57,7 @@ PHP NEWS
- Standard:
. Fix error check for proc_open() command. (ndossche)
. Fix memory leak in mail() when header key is numeric. (Girgias)
18 Dec 2025, PHP 8.4.16

3
ext/standard/mail.c
View File

@@ -214,7 +214,8 @@ PHPAPI zend_string *php_mail_build_headers(HashTable *headers)
ZEND_HASH_FOREACH_KEY_VAL(headers, idx, key, val) {
if (!key) {
zend_type_error("Header name cannot be numeric, " ZEND_LONG_FMT " given", idx);
break;
smart_str_free(&s);
return NULL;
}
ZVAL_DEREF(val);
/* https://tools.ietf.org/html/rfc2822#section-3.6 */

15
ext/standard/tests/mail/gh20776.phpt Normal file
View File

@@ -0,0 +1,15 @@
--TEST--
GH-20776: mail() memory leak when header array contains numeric keys
--FILE--
<?php
$to = "user@example.com";
$subject = $message = "";
try {
var_dump(mail($to, $subject, $message, ['RandomHeader' => 'Value', 5 => 'invalid key']));
} catch (Throwable $e) {
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
}
?>
--EXPECT--
TypeError: Header name cannot be numeric, 5 given