summaryrefslogtreecommitdiff
path: root/program/include/rcmail.php
diff options
context:
space:
mode:
authoralecpl <alec@alec.pl>2010-11-29 08:50:39 +0000
committeralecpl <alec@alec.pl>2010-11-29 08:50:39 +0000
commit9016a84f7b6009eeeda26e0096434a47fae7f298 (patch)
tree373bf34d3d1200cf591161ca7d311083c328ffb1 /program/include/rcmail.php
parent5f560ee7a08a0cc79a78cbf58ed1442b5f8d0d17 (diff)
- Handle PHP warning in decrypt function (#1485970)
Diffstat (limited to 'program/include/rcmail.php')
-rw-r--r--program/include/rcmail.php10
1 files changed, 8 insertions, 2 deletions
diff --git a/program/include/rcmail.php b/program/include/rcmail.php
index e76b1420a..d376e98bf 100644
--- a/program/include/rcmail.php
+++ b/program/include/rcmail.php
@@ -1203,8 +1203,14 @@ class rcmail
if (function_exists('mcrypt_module_open') &&
($td = mcrypt_module_open(MCRYPT_TripleDES, "", MCRYPT_MODE_CBC, "")))
{
- $iv = substr($cipher, 0, mcrypt_enc_get_iv_size($td));
- $cipher = substr($cipher, mcrypt_enc_get_iv_size($td));
+ $iv_size = mcrypt_enc_get_iv_size($td);
+ $iv = substr($cipher, 0, $iv_size);
+
+ // session corruption? (#1485970)
+ if (strlen($iv) < $iv_size)
+ return '';
+
+ $cipher = substr($cipher, $iv_size);
mcrypt_generic_init($td, $this->config->get_crypto_key($key), $iv);
$clear = mdecrypt_generic($td, $cipher);
mcrypt_generic_deinit($td);