From ec6a881a6ce4a079496eba20f96858cbe6771147 Mon Sep 17 00:00:00 2001
From: Yasuo Ohgaki <yohgaki@php.net>
Date: Wed, 13 May 2015 09:18:46 +0900
Subject: [PATCH 1/7] Fixed bug #68776

---
 ext/standard/mail.c                      |  80 +++++++
 ext/standard/tests/mail/mail_basic6.phpt | 263 +++++++++++++++++++++++
 2 files changed, 343 insertions(+)
 create mode 100644 ext/standard/tests/mail/mail_basic6.phpt

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index 1ebc8fecb7ef4..157687fb25a72 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -221,6 +221,76 @@ void php_mail_log_to_file(char *filename, char *message, size_t message_size TSR
 }
 
 
+static int php_mail_detect_multiple_crlf(char *hdr) {
+	/* This function detects malformed multiple newlines also */
+	char *tmp = hdr;
+
+	/* Should not have any newlines at the beginning */
+	while (*hdr && (*hdr == '\n' || *hdr == '\r')) {
+		hdr++;
+	}
+	if (tmp != hdr) {
+		return 1;
+	}
+
+	while(*hdr) {
+		if (*hdr == '\r') {
+			if (*(hdr+1) == '\r' || (*(hdr+1) == '\n' && (*(hdr+2) == '\n' || *(hdr+2) == '\r'))) {
+				/* Malformed or multiple newlines */
+				return 1;
+			} else {
+				hdr += 2;
+			}
+		} else if (*hdr == '\n') {
+			if (*(hdr+1) == '\r' || *(hdr+1) == '\n') {
+				/* Malformed or multiple newlines */
+				return 1;
+			} else {
+				hdr += 2;
+			}
+		} else {
+			hdr++;
+		}
+	}
+	return 0;
+}
+
+
+static int php_mail_detect_multiple_crlf(char *hdr) {
+	/* This function detects malformed multiple newlines also */
+	char *tmp = hdr;
+
+	/* Should not have any newlines at the beginning */
+	while (*hdr && (*hdr == '\n' || *hdr == '\r')) {
+		hdr++;
+	}
+	if (tmp != hdr) {
+		return 1;
+	}
+
+	while(*hdr) {
+		if (*hdr == '\r') {
+			if (*(hdr+1) == '\r' || (*(hdr+1) == '\n' && (*(hdr+2) == '\n' || *(hdr+2) == '\r'))) {
+				/* Malformed or multiple newlines */
+				return 1;
+			} else {
+				hdr += 2;
+			}
+		} else if (*hdr == '\n') {
+			if (*(hdr+1) == '\r' || *(hdr+1) == '\n') {
+				/* Malformed or multiple newlines */
+				return 1;
+			} else {
+				hdr += 2;
+			}
+		} else {
+			hdr++;
+		}
+	}
+	return 0;
+}
+
+
 /* {{{ php_mail
  */
 PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char *extra_cmd TSRMLS_DC)
@@ -281,6 +351,16 @@ PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char
 		efree(f);
 	}
 
+	if (hdr && php_mail_detect_multiple_crlf(hdr)) {
+		php_error_docref(NULL, E_WARNING, "Multiple or malformed newlines found in additional_header");
+		MAIL_RET(0);
+	}
+
+	if (hdr && php_mail_detect_multiple_crlf(hdr)) {
+		php_error_docref(NULL, E_WARNING, "Multiple or malformed newlines found in additional_header");
+		MAIL_RET(0);
+	}
+
 	if (!sendmail_path) {
 #if (defined PHP_WIN32 || defined NETWARE)
 		/* handle old style win smtp sending */
diff --git a/ext/standard/tests/mail/mail_basic6.phpt b/ext/standard/tests/mail/mail_basic6.phpt
new file mode 100644
index 0000000000000..eebe2f9455008
--- /dev/null
+++ b/ext/standard/tests/mail/mail_basic6.phpt
@@ -0,0 +1,263 @@
+--TEST--
+Test mail() function : basic functionality
+--INI--
+sendmail_path=tee mailBasic.out >/dev/null
+mail.add_x_header = Off
+--SKIPIF--
+<?php
+if(substr(PHP_OS, 0, 3) == "WIN")
+  die("skip Won't run on Windows");
+?>
+--FILE--
+<?php
+/* Prototype  : int mail(string to, string subject, string message [, string additional_headers [, string additional_parameters]])
+ * Description: Send an email message with invalid addtional_headers
+ * Source code: ext/standard/mail.c
+ * Alias to functions:
+ */
+
+echo "*** Testing mail() : basic functionality ***\n";
+
+
+// Valid header
+$to = 'user@example.com';
+$subject = 'Test Subject';
+$message = 'A Message';
+$additional_headers = "HEAD1: a\r\nHEAD2: b\r\n";
+$outFile = "mailBasic.out";
+@unlink($outFile);
+
+echo "-- Valid Header --\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo file_get_contents($outFile);
+unlink($outFile);
+
+// Valid header
+$additional_headers = "HEAD1: a\nHEAD2: b\n";
+@unlink($outFile);
+
+echo "-- Valid Header --\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Valid header
+// \r is accepted as valid. This may be changed to invalid.
+$additional_headers = "HEAD1: a\rHEAD2: b\r";
+@unlink($outFile);
+
+echo "-- Valid Header --\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+//===============================================================================
+// Invalid header
+$additional_headers = "\r\nHEAD1: a\r\nHEAD2: b\r\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - preceeding newline--\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Invalid header
+$additional_headers = "\r\n\r\nHEAD1: a\r\nHEAD2: b\r\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - preceeding newline--\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Invalid header
+$additional_headers = "\n\nHEAD1: a\r\nHEAD2: b\r\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - preceeding newline--\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Invalid header
+$additional_headers = "\r\rHEAD1: a\r\nHEAD2: b\r\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - preceeding newline--\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Invalid header
+$additional_headers = "HEAD1: a\r\n\r\nHEAD2: b\r\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - multiple newlines in the middle --\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Invalid header
+$additional_headers = "HEAD1: a\r\n\nHEAD2: b\r\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - multiple newlines in the middle --\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Invalid header
+$additional_headers = "HEAD1: a\n\nHEAD2: b\r\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - multiple newlines in the middle --\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Invalid header
+$additional_headers = "HEAD1: a\r\rHEAD2: b\r\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - multiple newlines in the middle --\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Invalid header
+$additional_headers = "HEAD1: a\n\rHEAD2: b\r\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - multiple newlines in the middle --\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Invalid header
+$additional_headers = "HEAD1: a\n\r\nHEAD2: b\r\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - multiple newlines in the middle --\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Invalid header
+// Invalid, but PHP_FUNCTION(mail) trims newlines
+$additional_headers = "HEAD1: a\r\nHEAD2: b\r\n\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - trailing newlines --\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Invalid header
+// Invalid, but PHP_FUNCTION(mail) trims newlines
+$additional_headers = "HEAD1: a\r\nHEAD2: b\n\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - trailing newlines --\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+?>
+===DONE===
+--EXPECTF--
+*** Testing mail() : basic functionality ***
+-- Valid Header --
+bool(true)
+To: user@example.com
+Subject: Test Subject
+HEAD1: a
+HEAD2: b
+
+A Message
+-- Valid Header --
+bool(true)
+To: user@example.com
+Subject: Test Subject
+HEAD1: a
+HEAD2: b
+
+A Message
+-- Valid Header --
+bool(true)
+To: user@example.com
+Subject: Test Subject
+HEAD1: a
HEAD2: b
+
+A Message
+-- Invalid Header - preceeding newline--
+
+Warning: mail(): Multiple or malformed newlines found in additional_header in %s/mail_basic6.php on line %d
+bool(false)
+-- Invalid Header - preceeding newline--
+
+Warning: mail(): Multiple or malformed newlines found in additional_header in %s/mail_basic6.php on line %d
+bool(false)
+-- Invalid Header - preceeding newline--
+
+Warning: mail(): Multiple or malformed newlines found in additional_header in %s/mail_basic6.php on line %d
+bool(false)
+-- Invalid Header - preceeding newline--
+
+Warning: mail(): Multiple or malformed newlines found in additional_header in %s/mail_basic6.php on line %d
+bool(false)
+-- Invalid Header - multiple newlines in the middle --
+
+Warning: mail(): Multiple or malformed newlines found in additional_header in %s/mail_basic6.php on line %d
+bool(false)
+-- Invalid Header - multiple newlines in the middle --
+
+Warning: mail(): Multiple or malformed newlines found in additional_header in %s/mail_basic6.php on line %d
+bool(false)
+-- Invalid Header - multiple newlines in the middle --
+
+Warning: mail(): Multiple or malformed newlines found in additional_header in %s/mail_basic6.php on line %d
+bool(false)
+-- Invalid Header - multiple newlines in the middle --
+
+Warning: mail(): Multiple or malformed newlines found in additional_header in %s/mail_basic6.php on line %d
+bool(false)
+-- Invalid Header - multiple newlines in the middle --
+
+Warning: mail(): Multiple or malformed newlines found in additional_header in %s/mail_basic6.php on line %d
+bool(false)
+-- Invalid Header - multiple newlines in the middle --
+
+Warning: mail(): Multiple or malformed newlines found in additional_header in %s/mail_basic6.php on line %d
+bool(false)
+-- Invalid Header - trailing newlines --
+bool(true)
+To: user@example.com
+Subject: Test Subject
+HEAD1: a
+HEAD2: b
+
+A Message
+-- Invalid Header - trailing newlines --
+bool(true)
+To: user@example.com
+Subject: Test Subject
+HEAD1: a
+HEAD2: b
+
+A Message
+===DONE===

From 8fd3c7be510dc190f8d03c0eb1d87d10f6711a6c Mon Sep 17 00:00:00 2001
From: Yasuo Ohgaki <yohgaki@php.net>
Date: Wed, 13 May 2015 15:13:19 +0900
Subject: [PATCH 2/7] Remove multiply applied patch

---
 ext/standard/mail.c | 40 ----------------------------------------
 1 file changed, 40 deletions(-)

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index 157687fb25a72..ade6c4aca393f 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -256,41 +256,6 @@ static int php_mail_detect_multiple_crlf(char *hdr) {
 }
 
 
-static int php_mail_detect_multiple_crlf(char *hdr) {
-	/* This function detects malformed multiple newlines also */
-	char *tmp = hdr;
-
-	/* Should not have any newlines at the beginning */
-	while (*hdr && (*hdr == '\n' || *hdr == '\r')) {
-		hdr++;
-	}
-	if (tmp != hdr) {
-		return 1;
-	}
-
-	while(*hdr) {
-		if (*hdr == '\r') {
-			if (*(hdr+1) == '\r' || (*(hdr+1) == '\n' && (*(hdr+2) == '\n' || *(hdr+2) == '\r'))) {
-				/* Malformed or multiple newlines */
-				return 1;
-			} else {
-				hdr += 2;
-			}
-		} else if (*hdr == '\n') {
-			if (*(hdr+1) == '\r' || *(hdr+1) == '\n') {
-				/* Malformed or multiple newlines */
-				return 1;
-			} else {
-				hdr += 2;
-			}
-		} else {
-			hdr++;
-		}
-	}
-	return 0;
-}
-
-
 /* {{{ php_mail
  */
 PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char *extra_cmd TSRMLS_DC)
@@ -356,11 +321,6 @@ PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char
 		MAIL_RET(0);
 	}
 
-	if (hdr && php_mail_detect_multiple_crlf(hdr)) {
-		php_error_docref(NULL, E_WARNING, "Multiple or malformed newlines found in additional_header");
-		MAIL_RET(0);
-	}
-
 	if (!sendmail_path) {
 #if (defined PHP_WIN32 || defined NETWARE)
 		/* handle old style win smtp sending */

From fc0266b31c13ce613cad9f49220e5a05551fb682 Mon Sep 17 00:00:00 2001
From: Yasuo Ohgaki <yohgaki@php.net>
Date: Mon, 8 Jun 2015 11:52:12 +0900
Subject: [PATCH 3/7] Remove assumption that php_trim() is applied, but
 php_trim() code is not removed for better compatibility. Add missing
 TSRMLS_CC.

---
 ext/standard/mail.c | 42 +++++++++++++++++++++++++++++++++---------
 1 file changed, 33 insertions(+), 9 deletions(-)

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index ade6c4aca393f..1c1b34014146d 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -222,28 +222,35 @@ void php_mail_log_to_file(char *filename, char *message, size_t message_size TSR
 
 
 static int php_mail_detect_multiple_crlf(char *hdr) {
-	/* This function detects malformed multiple newlines also */
+	/* This function detects multiple/malformed multiple newlines. */
 	char *tmp = hdr;
 
-	/* Should not have any newlines at the beginning */
-	while (*hdr && (*hdr == '\n' || *hdr == '\r')) {
+	/* Should not have any newlines at the beginning. */
+	while(*hdr) {
 		hdr++;
-	}
-	if (tmp != hdr) {
-		return 1;
+		if (*hdr == ' ') {
+			continue;
+		}
+		if (isprint(*hdr)) {
+			break;
+		}
+		if (iscntrl(*hdr)) {
+			/* Reject anything suspicious. */
+			return 1;
+		}
 	}
 
 	while(*hdr) {
 		if (*hdr == '\r') {
 			if (*(hdr+1) == '\r' || (*(hdr+1) == '\n' && (*(hdr+2) == '\n' || *(hdr+2) == '\r'))) {
-				/* Malformed or multiple newlines */
+				/* Malformed or multiple newlines. */
 				return 1;
 			} else {
 				hdr += 2;
 			}
 		} else if (*hdr == '\n') {
 			if (*(hdr+1) == '\r' || *(hdr+1) == '\n') {
-				/* Malformed or multiple newlines */
+				/* Malformed or multiple newlines. */
 				return 1;
 			} else {
 				hdr += 2;
@@ -252,6 +259,22 @@ static int php_mail_detect_multiple_crlf(char *hdr) {
 			hdr++;
 		}
 	}
+
+	/* Should not have any newlines at the end. */
+	while(*hdr && hdr != tmp) {
+		hdr--;
+		if (*hdr == ' ' || *hdr == '\t') {
+			continue;
+		}
+		if (isprint(*hdr)) {
+			break;
+		}
+		if (iscntrl(*hdr)) {
+			/* Reject anything suspicious. */
+			return 1;
+		}
+	}
+
 	return 0;
 }
 
@@ -301,6 +324,7 @@ PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char
 
 		efree(tmp);
 	}
+
 	if (PG(mail_x_header)) {
 		const char *tmp = zend_get_executed_filename(TSRMLS_C);
 		char *f;
@@ -317,7 +341,7 @@ PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char
 	}
 
 	if (hdr && php_mail_detect_multiple_crlf(hdr)) {
-		php_error_docref(NULL, E_WARNING, "Multiple or malformed newlines found in additional_header");
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Multiple or malformed newlines found in additional_header");
 		MAIL_RET(0);
 	}
 

From 89def6911128d8806fd10957a018334f0ca97d71 Mon Sep 17 00:00:00 2001
From: Yasuo Ohgaki <yohgaki@php.net>
Date: Mon, 8 Jun 2015 12:18:01 +0900
Subject: [PATCH 4/7] Fixed leading newline detection. Add cases for
 readling/trailing newlines

---
 ext/standard/mail.c                      |  6 ++-
 ext/standard/tests/mail/mail_basic6.phpt | 66 ++++++++++++++++++++++++
 2 files changed, 71 insertions(+), 1 deletion(-)

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index 1c1b34014146d..5a4e4aeaeffdc 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -225,9 +225,12 @@ static int php_mail_detect_multiple_crlf(char *hdr) {
 	/* This function detects multiple/malformed multiple newlines. */
 	char *tmp = hdr;
 
+	if (!hdr) {
+		return 0;
+	}
+
 	/* Should not have any newlines at the beginning. */
 	while(*hdr) {
-		hdr++;
 		if (*hdr == ' ') {
 			continue;
 		}
@@ -238,6 +241,7 @@ static int php_mail_detect_multiple_crlf(char *hdr) {
 			/* Reject anything suspicious. */
 			return 1;
 		}
+		hdr++;
 	}
 
 	while(*hdr) {
diff --git a/ext/standard/tests/mail/mail_basic6.phpt b/ext/standard/tests/mail/mail_basic6.phpt
index eebe2f9455008..d0d45b78f3dea 100644
--- a/ext/standard/tests/mail/mail_basic6.phpt
+++ b/ext/standard/tests/mail/mail_basic6.phpt
@@ -55,6 +55,26 @@ echo @file_get_contents($outFile);
 @unlink($outFile);
 
 //===============================================================================
+// Invalid header
+$additional_headers = "\nHEAD1: a\nHEAD2: b\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - preceeding newline--\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Invalid header
+$additional_headers = "\rHEAD1: a\nHEAD2: b\r";
+@unlink($outFile);
+
+echo "-- Invalid Header - preceeding newline--\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
 // Invalid header
 $additional_headers = "\r\nHEAD1: a\r\nHEAD2: b\r\n";
 @unlink($outFile);
@@ -177,6 +197,28 @@ var_dump( mail($to, $subject, $message, $additional_headers) );
 echo @file_get_contents($outFile);
 @unlink($outFile);
 
+// Invalid header
+// Invalid, but PHP_FUNCTION(mail) trims newlines
+$additional_headers = "HEAD1: a\r\nHEAD2: b\n";
+@unlink($outFile);
+
+echo "-- Invalid Header - trailing newlines --\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
+// Invalid header
+// Invalid, but PHP_FUNCTION(mail) trims newlines
+$additional_headers = "HEAD1: a\r\nHEAD2: b\r";
+@unlink($outFile);
+
+echo "-- Invalid Header - trailing newlines --\n";
+// Calling mail() with all additional headers
+var_dump( mail($to, $subject, $message, $additional_headers) );
+echo @file_get_contents($outFile);
+@unlink($outFile);
+
 ?>
 ===DONE===
 --EXPECTF--
@@ -218,6 +260,14 @@ Warning: mail(): Multiple or malformed newlines found in additional_header in %s
 bool(false)
 -- Invalid Header - preceeding newline--
 
+Warning: mail(): Multiple or malformed newlines found in additional_header in %s/mail_basic6.php on line %d
+bool(false)
+-- Invalid Header - preceeding newline--
+
+Warning: mail(): Multiple or malformed newlines found in additional_header in %s/mail_basic6.php on line %d
+bool(false)
+-- Invalid Header - preceeding newline--
+
 Warning: mail(): Multiple or malformed newlines found in additional_header in %s/mail_basic6.php on line %d
 bool(false)
 -- Invalid Header - multiple newlines in the middle --
@@ -259,5 +309,21 @@ Subject: Test Subject
 HEAD1: a
 HEAD2: b
 
+A Message
+-- Invalid Header - trailing newlines --
+bool(true)
+To: user@example.com
+Subject: Test Subject
+HEAD1: a
+HEAD2: b
+
+A Message
+-- Invalid Header - trailing newlines --
+bool(true)
+To: user@example.com
+Subject: Test Subject
+HEAD1: a
+HEAD2: b
+
 A Message
 ===DONE===

From 500b70df6b5a312d9d74512e5acddf9fd756a6e3 Mon Sep 17 00:00:00 2001
From: Yasuo Ohgaki <yohgaki@php.net>
Date: Mon, 8 Jun 2015 13:21:53 +0900
Subject: [PATCH 5/7] Simplify and better standard confirmance

---
 ext/standard/mail.c | 33 +++++++--------------------------
 1 file changed, 7 insertions(+), 26 deletions(-)

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index 5a4e4aeaeffdc..d96f5e415a342 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -223,25 +223,16 @@ void php_mail_log_to_file(char *filename, char *message, size_t message_size TSR
 
 static int php_mail_detect_multiple_crlf(char *hdr) {
 	/* This function detects multiple/malformed multiple newlines. */
-	char *tmp = hdr;
+	size_t len;
 
-	if (!hdr) {
+	if (!hdr || !(len = strlen(hdr))) {
 		return 0;
 	}
 
 	/* Should not have any newlines at the beginning. */
-	while(*hdr) {
-		if (*hdr == ' ') {
-			continue;
-		}
-		if (isprint(*hdr)) {
-			break;
-		}
-		if (iscntrl(*hdr)) {
-			/* Reject anything suspicious. */
-			return 1;
-		}
-		hdr++;
+	/* RFC 2822 2.2. Header Fields */
+	if (*hdr < 33 || *hdr > 126 || *hdr == ':') {
+		return 1;
 	}
 
 	while(*hdr) {
@@ -265,18 +256,8 @@ static int php_mail_detect_multiple_crlf(char *hdr) {
 	}
 
 	/* Should not have any newlines at the end. */
-	while(*hdr && hdr != tmp) {
-		hdr--;
-		if (*hdr == ' ' || *hdr == '\t') {
-			continue;
-		}
-		if (isprint(*hdr)) {
-			break;
-		}
-		if (iscntrl(*hdr)) {
-			/* Reject anything suspicious. */
-			return 1;
-		}
+	if(*(hdr+len-1) == '\n' || *(hdr+len-1) == '\r') {
+		return 1;
 	}
 
 	return 0;

From bbdb66948ae8dffb3715a3619afe764ac4c0e79b Mon Sep 17 00:00:00 2001
From: Yasuo Ohgaki <yohgaki@php.net>
Date: Tue, 9 Jun 2015 17:28:25 +0900
Subject: [PATCH 6/7] Fixed possible over read and consolidate trailing newline
 check

---
 ext/standard/mail.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index d96f5e415a342..8e02ac6194451 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -225,7 +225,7 @@ static int php_mail_detect_multiple_crlf(char *hdr) {
 	/* This function detects multiple/malformed multiple newlines. */
 	size_t len;
 
-	if (!hdr || !(len = strlen(hdr))) {
+	if (!hdr) {
 		return 0;
 	}
 
@@ -237,14 +237,14 @@ static int php_mail_detect_multiple_crlf(char *hdr) {
 
 	while(*hdr) {
 		if (*hdr == '\r') {
-			if (*(hdr+1) == '\r' || (*(hdr+1) == '\n' && (*(hdr+2) == '\n' || *(hdr+2) == '\r'))) {
+			if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || (*(hdr+1) == '\n' && (*(hdr+2) == '\n' || *(hdr+2) == '\r'))) {
 				/* Malformed or multiple newlines. */
 				return 1;
 			} else {
 				hdr += 2;
 			}
 		} else if (*hdr == '\n') {
-			if (*(hdr+1) == '\r' || *(hdr+1) == '\n') {
+			if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || *(hdr+1) == '\n') {
 				/* Malformed or multiple newlines. */
 				return 1;
 			} else {
@@ -255,11 +255,6 @@ static int php_mail_detect_multiple_crlf(char *hdr) {
 		}
 	}
 
-	/* Should not have any newlines at the end. */
-	if(*(hdr+len-1) == '\n' || *(hdr+len-1) == '\r') {
-		return 1;
-	}
-
 	return 0;
 }
 

From f46fdd7e710fc09d9e1c5db0483f499c57147123 Mon Sep 17 00:00:00 2001
From: Yasuo Ohgaki <yohgaki@php.net>
Date: Tue, 9 Jun 2015 17:31:44 +0900
Subject: [PATCH 7/7] Add one more null char check.

---
 ext/standard/mail.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index 8e02ac6194451..448013a472a34 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -237,7 +237,7 @@ static int php_mail_detect_multiple_crlf(char *hdr) {
 
 	while(*hdr) {
 		if (*hdr == '\r') {
-			if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || (*(hdr+1) == '\n' && (*(hdr+2) == '\n' || *(hdr+2) == '\r'))) {
+			if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || (*(hdr+1) == '\n' && (*(hdr+2) == '\0' || *(hdr+2) == '\n' || *(hdr+2) == '\r'))) {
 				/* Malformed or multiple newlines. */
 				return 1;
 			} else {