Bump imapengine from 1.25.4 to 1.25.6 and dependencies

libs/vendor/symfony/polyfill-intl-idn/Idn.php

@@ -61,6 +61,21 @@ final class Idn
     public const DELIMITER = '-';
     public const MAX_INT = 2147483647;
 
+    /**
+     * Punycode decoding does work quadratic in the payload length. Valid ACE
+     * labels are limited to 63 bytes, so payloads beyond this (generous) bound
+     * are rejected without being decoded to keep the work bounded.
+     */
+    private const MAX_DECODE_PAYLOAD_SIZE = 1024;
+
+    /**
+     * Encoding is quadratic the same way: it is O(n*r) in the length of a label
+     * and in its number of distinct code points. ext-intl never runs it on a
+     * domain this large, because it fails before converting when the result
+     * would not fit its own output buffer.
+     */
+    private const MAX_CODE_POINTS = 255;
+
     /**
      * Contains the numeric value of a basic code point (for use in representing integers) in the
      * range 0 to BASE-1, or -1 if b is does not represent a value.
@@ -153,6 +168,14 @@ final class Idn
             @trigger_error('idn_to_ascii(): INTL_IDNA_VARIANT_2003 is deprecated', \E_USER_DEPRECATED);
         }
 
+        // The ASCII form is at least as long as the number of code points in the
+        // domain, so beyond this many code points no result can fit in the output
+        // buffer ext-intl uses: it returns false there without reporting details,
+        // and so do we, rather than Punycode-encoding a label that cannot be used.
+        if (self::MAX_CODE_POINTS < \strlen((string) $domainName) && self::MAX_CODE_POINTS < self::countCodePoints((string) $domainName)) {
+            return false;
+        }
+
         $options = [
             'CheckHyphens' => true,
             'CheckBidi' => self::INTL_IDNA_VARIANT_2003 === $variant || 0 !== ($options & self::IDNA_CHECK_BIDI),
@@ -358,6 +381,16 @@ final class Idn
                     continue;
                 }
 
+                // The decoder does work quadratic in the payload length. Valid
+                // labels are at most 63 bytes long, so a payload beyond this
+                // bound is always invalid input: reject it without decoding,
+                // like ext-intl does, to avoid spending unbounded time on it.
+                if (\strlen($label) - 4 > self::MAX_DECODE_PAYLOAD_SIZE) {
+                    $info->errors |= self::ERROR_PUNYCODE;
+
+                    continue;
+                }
+
                 // Step 4.2. Attempt to convert the rest of the label to Unicode according to Punycode [RFC3492]. If
                 // that conversion fails, record that there was an error, and continue
                 // with the next label. Otherwise replace the original label in the string by the results of the
@@ -766,6 +799,24 @@ final class Idn
         return $output;
     }
 
+    /**
+     * Counts the code points of a UTF-8 string, malformed bytes included.
+     *
+     * This is the expression Mbstring::mb_strlen() falls back to in
+     * symfony/polyfill-mbstring, inlined because this package does not depend on it.
+     * Counting only the bytes that can start a sequence would be shorter, but then a
+     * run of continuation bytes would pad a label without being counted, which is the
+     * one thing this bound has to prevent.
+     *
+     * @param string $input
+     *
+     * @return int
+     */
+    private static function countCodePoints($input)
+    {
+        return preg_match_all('/[\x00-\x7F]|[\xC0-\xDF][\x80-\xBF]?|[\xE0-\xEF][\x80-\xBF]{0,2}|[\xF0-\xF7][\x80-\xBF]{0,3}|[\xF8-\xFB][\x80-\xBF]{0,4}|[\xFC-\xFD][\x80-\xBF]{0,5}|[\x80-\xBF\xFE\xFF]/s', $input);
+    }
+
     /**
      * @see https://tools.ietf.org/html/rfc3492#section-6.1
      *