File php-5.1.2-MOPB-33-2007.patch of Package php

--- ext/standard/mail.c	2007/01/25 00:26:51	1.87.2.1.2.2
+++ ext/standard/mail.c	2007/03/27 00:13:09	1.87.2.1.2.3
@@ -55,6 +55,14 @@
 		continue;											\
 	}													\
 
+#define MAIL_ASCIIZ_CHECK(str, len)			\
+	p = str;					\
+	e = p + len;					\
+	while (p = memchr(p, '\0', (e - p))) {		\
+		*p = ' ';				\
+	}						\
+
+
 /* {{{ proto int ezmlm_hash(string addr)
    Calculate EZMLM list hash value. */
 PHP_FUNCTION(ezmlm_hash)
@@ -88,6 +96,7 @@
 	int subject_len, extra_cmd_len, i;
 	char *force_extra_parameters = INI_STR("mail.force_extra_parameters");
 	char *to_r, *subject_r;
+	char *p, *e;
 
 	if (PG(safe_mode) && (ZEND_NUM_ARGS() == 5)) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SAFE MODE Restriction in effect.  The fifth parameter is disabled in SAFE MODE.");
@@ -104,6 +113,17 @@
 		return;
 	}
 
+	/* ASCIIZ check */
+	MAIL_ASCIIZ_CHECK(to, to_len);
+	MAIL_ASCIIZ_CHECK(subject, subject_len);
+	MAIL_ASCIIZ_CHECK(message, message_len);
+	if (headers) {
+		MAIL_ASCIIZ_CHECK(headers, headers_len);
+	}
+	if (extra_cmd) {
+		MAIL_ASCIIZ_CHECK(extra_cmd, extra_cmd_len);
+	}
+
 	if (to_len > 0) {
 		to_r = estrndup(to, to_len);
 		for (; to_len; to_len--) {
@@ -150,7 +170,7 @@
 	} else if (extra_cmd) {
 		extra_cmd = php_escape_shell_cmd(extra_cmd);
 	}
-	
+
 	if (php_mail(to_r, subject_r, message, headers, extra_cmd TSRMLS_CC)) {
 		RETVAL_TRUE;
 	} else {