From 9c9051d1f6dc4754d3411bdf7cec7cb76d38dfcb Mon Sep 17 00:00:00 2001 From: alec Date: Mon, 29 Nov 2010 08:50:39 +0000 Subject: - Handle PHP warning in decrypt function (#1485970) git-svn-id: https://svn.roundcube.net/trunk@4287 208e9e7b-5314-0410-a742-e7e81cd9613c --- roundcubemail/program/include/rcmail.php | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'roundcubemail/program') diff --git a/roundcubemail/program/include/rcmail.php b/roundcubemail/program/include/rcmail.php index e76b1420a..d376e98bf 100644 --- a/roundcubemail/program/include/rcmail.php +++ b/roundcubemail/program/include/rcmail.php @@ -1203,8 +1203,14 @@ class rcmail if (function_exists('mcrypt_module_open') && ($td = mcrypt_module_open(MCRYPT_TripleDES, "", MCRYPT_MODE_CBC, ""))) { - $iv = substr($cipher, 0, mcrypt_enc_get_iv_size($td)); - $cipher = substr($cipher, mcrypt_enc_get_iv_size($td)); + $iv_size = mcrypt_enc_get_iv_size($td); + $iv = substr($cipher, 0, $iv_size); + + // session corruption? (#1485970) + if (strlen($iv) < $iv_size) + return ''; + + $cipher = substr($cipher, $iv_size); mcrypt_generic_init($td, $this->config->get_crypto_key($key), $iv); $clear = mdecrypt_generic($td, $cipher); mcrypt_generic_deinit($td); -- cgit v1.2.3