diff --git a/CHANGELOG b/CHANGELOG index 145ed4474..57528c29a 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -63,6 +63,7 @@ CHANGELOG Roundcube Webmail - Fix untagged COPYUID responses handling - again (#5982) - Fix PHP warning "idn_to_utf8(): INTL_IDNA_VARIANT_2003 is deprecated" with PHP 7.2 (#6075) - Fix bug where Archive folder wasn't auto-created on login with create_default_folders=true +- Fix performance issue when parsing malformed and long Date header (#6087) RELEASE 1.3.3 ------------- diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php index 4cae55999..70a459845 100644 --- a/program/lib/Roundcube/rcube_utils.php +++ b/program/lib/Roundcube/rcube_utils.php @@ -729,15 +729,19 @@ class rcube_utils return (int) $date; } + // It can be very slow when provided string is not a date and very long + if (strlen($date) > 128) { + $date = substr($date, 0, 128); + } + // if date parsing fails, we have a date in non-rfc format. // remove token from the end and try again - while ((($ts = @strtotime($date . $tzname)) === false) || ($ts < 0)) { - $d = explode(' ', $date); - array_pop($d); - if (!$d) { + while (($ts = @strtotime($date . $tzname)) === false || $ts < 0) { + if (($pos = strrpos($date, ' ')) === false) { break; } - $date = implode(' ', $d); + + $date = rtrim(substr($date, 0, $pos)); } return (int) $ts;