mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-12-04 23:34:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.4' into PHP-8.0

Browse Source 
* PHP-7.4:
  Fix #80242: imap_mail_compose() segfaults for multipart with rfc822
This commit is contained in:
Christoph M. Becker 2020-10-20 19:01:56 +02:00
commit edd8bd64ba
3 changed files with 37 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -9,6 +9,8 @@ PHP NEWS
- IMAP:
. Fixed bug #80239 (imap_rfc822_write_address() leaks memory). (cmb)
. Fixed minor regression caused by fixing bug #80220. (cmb)
. Fixed bug #80242 (imap_mail_compose() segfaults for multipart with rfc822).
(cmb)
- Opcache:
. Fixed bug #80255 (Opcache bug (bad condition result) in 8.0.0rc1). (Nikita)

22
ext/imap/php_imap.c
View File

@ -3375,15 +3375,19 @@ PHP_FUNCTION(imap_mail_compose)
bod->disposition.parameter = disp_param;
}
}
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "contents.data", sizeof("contents.data") - 1)) != NULL) {
convert_to_string_ex(pvalue);
bod->contents.text.data = fs_get(Z_STRLEN_P(pvalue) + 1);
memcpy(bod->contents.text.data, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue) + 1);
bod->contents.text.size = Z_STRLEN_P(pvalue);
if (bod->type == TYPEMESSAGE && bod->subtype && !strcmp(bod->subtype, "RFC822")) {
bod->nested.msg = mail_newmsg();
} else {
bod->contents.text.data = fs_get(1);
memcpy(bod->contents.text.data, "", 1);
bod->contents.text.size = 0;
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "contents.data", sizeof("contents.data") - 1)) != NULL) {
convert_to_string_ex(pvalue);
bod->contents.text.data = fs_get(Z_STRLEN_P(pvalue) + 1);
memcpy(bod->contents.text.data, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue) + 1);
bod->contents.text.size = Z_STRLEN_P(pvalue);
} else {
bod->contents.text.data = fs_get(1);
memcpy(bod->contents.text.data, "", 1);
bod->contents.text.size = 0;
}
}
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "lines", sizeof("lines") - 1)) != NULL) {
bod->size.lines = zval_get_long(pvalue);
@ -3485,7 +3489,7 @@ PHP_FUNCTION(imap_mail_compose)
bod=&part->body;
spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data, CRLF);
spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data ? (char *) bod->contents.text.data : "", CRLF);
efree(mystring);
mystring=tempstring;
} while ((part = part->next)); /* until done */

22
ext/imap/tests/bug80242.phpt Normal file
View File

@ -0,0 +1,22 @@
--TEST--
Bug #80242 (imap_mail_compose() segfaults for multipart with rfc822)
--SKIPIF--
<?php
if (!extension_loaded('imap')) die('skip imap extension not available');
?>
--FILE--
<?php
$bodies = [[
'type' => TYPEMULTIPART,
], [
'type' => TYPETEXT,
'contents.data' => 'some text',
], [
'type' => TYPEMESSAGE,
'subtype' => 'RFC822',
]];
imap_mail_compose([], $bodies);
echo "done\n";
?>
--EXPECT--
done