[PECL-CVS] [pecl-mail-mailparse] master: Fix out-of-bounds token read on trailing address delimiters

Author: Ilia Alshanetsky (iliaal)
Committer: Remi Collet (remicollet)
Date: 2026-06-18T08:40:51+02:00

Commit: https://github.com/php/pecl-mail-mailparse/commit/b28ae66561bcdc330e2c741d545560b7d499aff6
Raw diff: https://github.com/php/pecl-mail-mailparse/commit/b28ae66561bcdc330e2c741d545560b7d499aff6.diff

Fix out-of-bounds token read on trailing address delimiters

When the delimiter-skip loop in parse_address_tokens() advances start_tok
to exactly toks->ntokens (an address followed by one or more trailing ','
or ';'), the addr-spec branch read toks->tokens[start_tok].token with
start_tok == ntokens, one element past the ecalloc'd token array.
mailparse_rfc822_parse_addresses("a@b,,") triggers it.

Only strip the enclosing <> when the address span is non-empty
(a_count > 0), which also guarantees a_start < ntokens. The route-addr
branch is already guarded by its i < ntokens entry condition.

Change applied to both the .re source and the generated .c.

Changed paths:
  A  tests/addr_trailing_delim_oob.phpt
  M  package.xml
  M  php_mailparse_rfc822.c
  M  php_mailparse_rfc822.re


Diff:

diff --git a/package.xml b/package.xml
index 7cae640..6060137 100644
--- a/package.xml
+++ b/package.xml
@@ -83,6 +83,7 @@ It can deal with rfc822 and rfc2045 (MIME) compliant messages.
     <file name="012-stream.phpt" role="test" />
     <file name="012-var.phpt" role="test" />
     <file name="013.phpt" role="test" />
+    <file name="addr_trailing_delim_oob.phpt" role="test" />
     <file name="bug001.phpt" role="test" />
     <file name="bug73110.phpt" role="test" />
     <file name="bug74223.phpt" role="test" />
diff --git a/php_mailparse_rfc822.c b/php_mailparse_rfc822.c
index 28a001a..c66d802 100644
--- a/php_mailparse_rfc822.c
+++ b/php_mailparse_rfc822.c
@@ -1,4 +1,4 @@
-/* Generated by re2c 3.1 on Wed Jul 30 12:30:59 2025 */
+/* Generated by re2c 3.1 on Thu Jun 18 08:39:03 2026 */
 #line 1 "/home/php/git/mailparse/php_mailparse_rfc822.re"
 /*
    +----------------------------------------------------------------------+
@@ -547,7 +547,7 @@ static void parse_address_tokens(php_rfc822_tokenized_t *toks,
 			a_count = i - start_tok;
 			/* if an address is enclosed in <>, leave them out of the the
 			 * address value that we return */
-			if (toks->tokens[a_start].token == '<') {
+			if (a_count > 0 && toks->tokens[a_start].token == '<') {
 				a_start++;
 				a_count--;
 			}
diff --git a/php_mailparse_rfc822.re b/php_mailparse_rfc822.re
index 98699ac..c22dabb 100644
--- a/php_mailparse_rfc822.re
+++ b/php_mailparse_rfc822.re
@@ -410,7 +410,7 @@ mailbox:	/* addr-spec / phrase route-addr */
 			a_count = i - start_tok;
 			/* if an address is enclosed in <>, leave them out of the the
 			 * address value that we return */
-			if (toks->tokens[a_start].token == '<') {
+			if (a_count > 0 && toks->tokens[a_start].token == '<') {
 				a_start++;
 				a_count--;
 			}
diff --git a/tests/addr_trailing_delim_oob.phpt b/tests/addr_trailing_delim_oob.phpt
new file mode 100644
index 0000000..1502ac0
--- /dev/null
+++ b/tests/addr_trailing_delim_oob.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Trailing delimiters in an address list do not read past the token array
+--SKIPIF--
+<?php if (!extension_loaded("mailparse")) print "skip"; ?>
+--FILE--
+<?php
+$r = mailparse_rfc822_parse_addresses("a@b,,");
+var_dump($r[0]['address']);
+$r = mailparse_rfc822_parse_addresses("grp: a@b,,");
+var_dump($r[0]['is_group']);
+echo "done\n";
+?>
+--EXPECT--
+string(3) "a@b"
+bool(true)
+done