Skip to content

Fix memory leak when a plain parameter repeats an RFC2231 name#66

Closed
iliaal wants to merge 1 commit into
masterfrom
fix/rfc2231-duplicate-name-leak
Closed

Fix memory leak when a plain parameter repeats an RFC2231 name#66
iliaal wants to merge 1 commit into
masterfrom
fix/rfc2231-duplicate-name-leak

Conversation

@iliaal

@iliaal iliaal commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

What

A plain MIME parameter whose name matches an active RFC2231 continuation leaks the parameter-name string. The leak size is the attacker-controlled name length and it repeats per occurrence, so a crafted header stream is a slow memory-exhaustion vector.

Example: Content-Type: text/plain; URL*0="a"; URL="b". The URL="b" parameter shares the base name of the URL*0 continuation; its emalloc'd name is neither stored nor freed.

Fix

In php_mimeheader_alloc_from_tok, when the active RFC2231 name matches the new plain parameter, free the duplicate name. The guard is name != name_buf so it only frees a separate allocation, never the live name_buf that the first encoded parameter aliases (which would be a use-after-free on the next iteration).

@iliaal

iliaal commented Jun 19, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #71, reopened from the fork (iliaal/pecl-mail-mailparse). Branch should not have been pushed to php/ directly.

@iliaal iliaal closed this Jun 19, 2026
@iliaal iliaal deleted the fix/rfc2231-duplicate-name-leak branch June 19, 2026 13:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant