Skip to content

Commit 6494e57

Browse files
cmb69cmb69
committed
Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4: Fix #80215: imap_mail_compose() may modify by-val parameters
2 parents 7d085c8 + 7940fb4 commit 6494e57

File tree

3 files changed

+78
-1
lines changed

3 files changed

+78
-1
lines changed

‎NEWS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ PHP NEWS
88

99
- IMAP:
1010
. Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies). (cmb)
11+
. Fixed bug #80215 (imap_mail_compose() may modify by-val parameters). (cmb)
1112

1213
- Opcache:
1314
. Fixed bug #80184 (Complex expression in while / if statements resolves to

‎ext/imap/php_imap.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3093,7 +3093,7 @@ PHP_FUNCTION(imap_mail_compose)
30933093
int toppart = 0;
30943094
int first;
30953095

3096-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "aa", &envelope, &body) == FAILURE) {
3096+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "a/a/", &envelope, &body) == FAILURE) {
30973097
RETURN_THROWS();
30983098
}
30993099

@@ -3151,6 +3151,7 @@ PHP_FUNCTION(imap_mail_compose)
31513151
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "custom_headers", sizeof("custom_headers") - 1)) != NULL) {
31523152
if (Z_TYPE_P(pvalue) == IS_ARRAY) {
31533153
custom_headers_param = tmp_param = NULL;
3154+
SEPARATE_ARRAY(pvalue);
31543155
ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(pvalue), env_data) {
31553156
custom_headers_param = mail_newbody_parameter();
31563157
convert_to_string_ex(env_data);
@@ -3173,6 +3174,7 @@ PHP_FUNCTION(imap_mail_compose)
31733174
php_error_docref(NULL, E_WARNING, "body parameter must be a non-empty array");
31743175
RETURN_FALSE;
31753176
}
3177+
SEPARATE_ARRAY(data);
31763178

31773179
bod = mail_newbody();
31783180
topbod = bod;
@@ -3194,6 +3196,7 @@ PHP_FUNCTION(imap_mail_compose)
31943196
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type.parameters", sizeof("type.parameters") - 1)) != NULL) {
31953197
if(Z_TYPE_P(pvalue) == IS_ARRAY) {
31963198
disp_param = tmp_param = NULL;
3199+
SEPARATE_ARRAY(pvalue);
31973200
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
31983201
if (key == NULL) continue;
31993202
disp_param = mail_newbody_parameter();
@@ -3227,6 +3230,7 @@ PHP_FUNCTION(imap_mail_compose)
32273230
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "disposition", sizeof("disposition") - 1)) != NULL) {
32283231
if (Z_TYPE_P(pvalue) == IS_ARRAY) {
32293232
disp_param = tmp_param = NULL;
3233+
SEPARATE_ARRAY(pvalue);
32303234
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
32313235
if (key == NULL) continue;
32323236
disp_param = mail_newbody_parameter();
@@ -3262,6 +3266,7 @@ PHP_FUNCTION(imap_mail_compose)
32623266
}
32633267
} else if (Z_TYPE_P(data) == IS_ARRAY) {
32643268
short type = -1;
3269+
SEPARATE_ARRAY(data);
32653270
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type", sizeof("type") - 1)) != NULL) {
32663271
type = (short) zval_get_long(pvalue);
32673272
}
@@ -3296,6 +3301,7 @@ PHP_FUNCTION(imap_mail_compose)
32963301
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type.parameters", sizeof("type.parameters") - 1)) != NULL) {
32973302
if (Z_TYPE_P(pvalue) == IS_ARRAY) {
32983303
disp_param = tmp_param = NULL;
3304+
SEPARATE_ARRAY(pvalue);
32993305
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
33003306
if (key == NULL) continue;
33013307
disp_param = mail_newbody_parameter();
@@ -3329,6 +3335,7 @@ PHP_FUNCTION(imap_mail_compose)
33293335
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "disposition", sizeof("disposition") - 1)) != NULL) {
33303336
if (Z_TYPE_P(pvalue) == IS_ARRAY) {
33313337
disp_param = tmp_param = NULL;
3338+
SEPARATE_ARRAY(pvalue);
33323339
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
33333340
if (key == NULL) continue;
33343341
disp_param = mail_newbody_parameter();

‎ext/imap/tests/bug80215.phpt

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
--TEST--
2+
Bug #80215 (imap_mail_compose() may modify by-val parameters)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('imap')) die('skip imap extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
$envelope = [
10+
"from" => 1,
11+
"to" => 2,
12+
"custom_headers" => [3],
13+
];
14+
$body = [[
15+
"contents.data" => 4,
16+
"type.parameters" => ['foo' => 5],
17+
"disposition" => ['bar' => 6],
18+
], [
19+
"contents.data" => 7,
20+
"type.parameters" => ['foo' => 8],
21+
"disposition" => ['bar' => 9],
22+
]];
23+
imap_mail_compose($envelope, $body);
24+
var_dump($envelope, $body);
25+
?>
26+
--EXPECT--
27+
array(3) {
28+
["from"]=>
29+
int(1)
30+
["to"]=>
31+
int(2)
32+
["custom_headers"]=>
33+
array(1) {
34+
[0]=>
35+
int(3)
36+
}
37+
}
38+
array(2) {
39+
[0]=>
40+
array(3) {
41+
["contents.data"]=>
42+
int(4)
43+
["type.parameters"]=>
44+
array(1) {
45+
["foo"]=>
46+
int(5)
47+
}
48+
["disposition"]=>
49+
array(1) {
50+
["bar"]=>
51+
int(6)
52+
}
53+
}
54+
[1]=>
55+
array(3) {
56+
["contents.data"]=>
57+
int(7)
58+
["type.parameters"]=>
59+
array(1) {
60+
["foo"]=>
61+
int(8)
62+
}
63+
["disposition"]=>
64+
array(1) {
65+
["bar"]=>
66+
int(9)
67+
}
68+
}
69+
}

0 commit comments

Comments
 (0)