ext/standard: reject control characters in the from address

ext/standard/ftp_fopen_wrapper.c

@@ -264,6 +264,7 @@ static php_stream *php_ftp_fopen_connect(php_stream_wrapper *wrapper, const char
 			/* if the user has configured who they are,
 			   send that as the password */
 			if (FG(from_address)) {
+				PHP_FTP_CNTRL_CHK(FG(from_address), strlen(FG(from_address)), "Invalid password %s")
 				php_stream_printf(stream, "PASS %s\r\n", FG(from_address));
 			} else {
 				php_stream_write_string(stream, "PASS anonymous\r\n");

ext/standard/http_fopen_wrapper.c

@@ -82,6 +82,20 @@
 #define HTTP_WRAPPER_REDIRECTED     2
 #define HTTP_WRAPPER_KEEP_METHOD    4
 
+static bool php_http_valid_from_address(const char *from)
+{
+	const unsigned char *s = (const unsigned char *) from;
+
+	while (*s) {
+		if (iscntrl(*s)) {
+			return false;
+		}
+		s++;
+	}
+
+	return true;
+}
+
 static inline void strip_header(char *header_bag, char *lc_header_bag,
 		const char *lc_header_name)
 {
@@ -783,9 +797,13 @@ static php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper,
 
 	/* if the user has configured who they are, send a From: line */
 	if (!(have_header & HTTP_HEADER_FROM) && FG(from_address)) {
-		smart_str_appends(&req_buf, "From: ");
-		smart_str_appends(&req_buf, FG(from_address));
-		smart_str_appends(&req_buf, "\r\n");
+		if (php_http_valid_from_address(FG(from_address))) {
+			smart_str_appends(&req_buf, "From: ");
+			smart_str_appends(&req_buf, FG(from_address));
+			smart_str_appends(&req_buf, "\r\n");
+		} else {
+			php_error_docref(NULL, E_WARNING, "Cannot construct From header");
+		}
 	}
 
 	/* Send Host: header so name-based virtual hosts work */

ext/standard/tests/http/from_address_cntrl.phpt

@@ -0,0 +1,36 @@
+--TEST--
+http wrapper must not build a From header from a from address with control characters
+--INI--
+allow_url_fopen=1
+--SKIPIF--
+<?php
+require 'server.inc'; http_server_skipif();
+?>
+--FILE--
+<?php
+require 'server.inc';
+
+$responses = [
+    "data://text/plain,HTTP/1.0 200 OK\r\nContent-Length: 2\r\n\r\nOK",
+    "data://text/plain,HTTP/1.0 200 OK\r\nContent-Length: 2\r\n\r\nOK",
+];
+
+['pid' => $pid, 'uri' => $uri] = http_server($responses, $output);
+
+ini_set('from', "evil@example.com\r\nX-Injected: yes");
+file_get_contents($uri);
+
+ini_set('from', 'me@example.com');
+file_get_contents($uri);
+
+http_server_kill($pid);
+
+rewind($output);
+$sent = stream_get_contents($output);
+var_dump(str_contains($sent, 'X-Injected'));
+var_dump(str_contains($sent, 'From: me@example.com'));
+?>
+--EXPECTF--
+Warning: file_get_contents(): Cannot construct From header in %s on line %d
+bool(false)
+bool(true)

ext/standard/tests/network/ftp_from_pass_cntrl.phpt

@@ -0,0 +1,55 @@
+--TEST--
+FTP anonymous PASS from the from address must reject control characters
+--SKIPIF--
+<?php
+if (array_search('ftp', stream_get_wrappers()) === false) die('skip ftp wrapper not available.');
+if (!function_exists('pcntl_fork')) die('skip pcntl_fork() not available.');
+?>
+--FILE--
+<?php
+$log = tmpfile();
+
+$socket = stream_socket_server("tcp://127.0.0.1:0", $errno, $errstr);
+if (!$socket) {
+    die("server failed\n");
+}
+$name = stream_socket_get_name($socket, false);
+$port = (int) substr($name, strrpos($name, ':') + 1);
+
+$pid = pcntl_fork();
+if ($pid === 0) {
+    pcntl_alarm(60);
+    $s = stream_socket_accept($socket, 10);
+    if (!$s) {
+        exit(1);
+    }
+    fputs($s, "220 ready\r\n");
+    stream_set_timeout($s, 1);
+    $seen = '';
+    while (($buf = fgets($s)) !== false) {
+        $seen .= $buf;
+        if (str_starts_with($buf, 'USER')) {
+            fputs($s, "331 need pass\r\n");
+        } elseif (str_starts_with($buf, 'PASS')) {
+            fputs($s, "230 ok\r\n");
+        } else {
+            fputs($s, "500 no\r\n");
+        }
+    }
+    fwrite($log, $seen);
+    exit(0);
+}
+
+ini_set('from', "evil\r\nSITE INJECT");
+var_dump(@fopen("ftp://127.0.0.1:{$port}/x", "r"));
+pcntl_waitpid($pid, $status);
+
+rewind($log);
+$seen = stream_get_contents($log);
+var_dump(str_contains($seen, 'SITE INJECT'));
+var_dump(str_contains($seen, 'PASS'));
+?>
+--EXPECT--
+bool(false)
+bool(false)
+bool(false)