Skip to content

Fix memory leak when a plain parameter repeats an RFC2231 name#71

Open
iliaal wants to merge 1 commit into
php:masterfrom
iliaal:fix/rfc2231-duplicate-name-leak
Open

Fix memory leak when a plain parameter repeats an RFC2231 name#71
iliaal wants to merge 1 commit into
php:masterfrom
iliaal:fix/rfc2231-duplicate-name-leak

Conversation

@iliaal

@iliaal iliaal commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

What

A plain MIME parameter whose name matches an active RFC2231 continuation leaks the parameter-name string. The leak size is the attacker-controlled name length and it repeats per occurrence, so a crafted header stream is a slow memory-exhaustion vector.

Example: Content-Type: text/plain; URL*0="a"; URL="b". The URL="b" parameter shares the base name of the URL*0 continuation; its emalloc'd name is neither stored nor freed.

Fix

In php_mimeheader_alloc_from_tok, when the active RFC2231 name matches the new plain parameter, free the duplicate name. The guard is name != name_buf so it only frees a separate allocation, never the live name_buf that the first encoded parameter aliases (which would be a use-after-free on the next iteration).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant