Skip to content

Commit 7940fb4

Browse files
cmb69cmb69
committed
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3: Fix #80215: imap_mail_compose() may modify by-val parameters
2 parents b2b9e2e + 62a2387 commit 7940fb4

File tree

3 files changed

+78
-1
lines changed

3 files changed

+78
-1
lines changed

‎NEWS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ PHP NEWS
1515

1616
- IMAP:
1717
. Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies). (cmb)
18+
. Fixed bug #80215 (imap_mail_compose() may modify by-val parameters). (cmb)
1819

1920
- MySQLnd:
2021
. Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with

‎ext/imap/php_imap.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3556,7 +3556,7 @@ PHP_FUNCTION(imap_mail_compose)
35563556
int toppart = 0;
35573557
int first;
35583558

3559-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "aa", &envelope, &body) == FAILURE) {
3559+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "a/a/", &envelope, &body) == FAILURE) {
35603560
return;
35613561
}
35623562

@@ -3614,6 +3614,7 @@ PHP_FUNCTION(imap_mail_compose)
36143614
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "custom_headers", sizeof("custom_headers") - 1)) != NULL) {
36153615
if (Z_TYPE_P(pvalue) == IS_ARRAY) {
36163616
custom_headers_param = tmp_param = NULL;
3617+
SEPARATE_ARRAY(pvalue);
36173618
ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(pvalue), env_data) {
36183619
custom_headers_param = mail_newbody_parameter();
36193620
convert_to_string_ex(env_data);
@@ -3635,6 +3636,7 @@ PHP_FUNCTION(imap_mail_compose)
36353636
php_error_docref(NULL, E_WARNING, "body parameter must be a non-empty array");
36363637
RETURN_FALSE;
36373638
}
3639+
SEPARATE_ARRAY(data);
36383640

36393641
bod = mail_newbody();
36403642
topbod = bod;
@@ -3656,6 +3658,7 @@ PHP_FUNCTION(imap_mail_compose)
36563658
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type.parameters", sizeof("type.parameters") - 1)) != NULL) {
36573659
if(Z_TYPE_P(pvalue) == IS_ARRAY) {
36583660
disp_param = tmp_param = NULL;
3661+
SEPARATE_ARRAY(pvalue);
36593662
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
36603663
if (key == NULL) continue;
36613664
disp_param = mail_newbody_parameter();
@@ -3689,6 +3692,7 @@ PHP_FUNCTION(imap_mail_compose)
36893692
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "disposition", sizeof("disposition") - 1)) != NULL) {
36903693
if (Z_TYPE_P(pvalue) == IS_ARRAY) {
36913694
disp_param = tmp_param = NULL;
3695+
SEPARATE_ARRAY(pvalue);
36923696
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
36933697
if (key == NULL) continue;
36943698
disp_param = mail_newbody_parameter();
@@ -3724,6 +3728,7 @@ PHP_FUNCTION(imap_mail_compose)
37243728
}
37253729
} else if (Z_TYPE_P(data) == IS_ARRAY) {
37263730
short type = -1;
3731+
SEPARATE_ARRAY(data);
37273732
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type", sizeof("type") - 1)) != NULL) {
37283733
type = (short) zval_get_long(pvalue);
37293734
}
@@ -3758,6 +3763,7 @@ PHP_FUNCTION(imap_mail_compose)
37583763
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type.parameters", sizeof("type.parameters") - 1)) != NULL) {
37593764
if (Z_TYPE_P(pvalue) == IS_ARRAY) {
37603765
disp_param = tmp_param = NULL;
3766+
SEPARATE_ARRAY(pvalue);
37613767
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
37623768
if (key == NULL) continue;
37633769
disp_param = mail_newbody_parameter();
@@ -3791,6 +3797,7 @@ PHP_FUNCTION(imap_mail_compose)
37913797
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "disposition", sizeof("disposition") - 1)) != NULL) {
37923798
if (Z_TYPE_P(pvalue) == IS_ARRAY) {
37933799
disp_param = tmp_param = NULL;
3800+
SEPARATE_ARRAY(pvalue);
37943801
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
37953802
if (key == NULL) continue;
37963803
disp_param = mail_newbody_parameter();

‎ext/imap/tests/bug80215.phpt

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
--TEST--
2+
Bug #80215 (imap_mail_compose() may modify by-val parameters)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('imap')) die('skip imap extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
$envelope = [
10+
"from" => 1,
11+
"to" => 2,
12+
"custom_headers" => [3],
13+
];
14+
$body = [[
15+
"contents.data" => 4,
16+
"type.parameters" => ['foo' => 5],
17+
"disposition" => ['bar' => 6],
18+
], [
19+
"contents.data" => 7,
20+
"type.parameters" => ['foo' => 8],
21+
"disposition" => ['bar' => 9],
22+
]];
23+
imap_mail_compose($envelope, $body);
24+
var_dump($envelope, $body);
25+
?>
26+
--EXPECT--
27+
array(3) {
28+
["from"]=>
29+
int(1)
30+
["to"]=>
31+
int(2)
32+
["custom_headers"]=>
33+
array(1) {
34+
[0]=>
35+
int(3)
36+
}
37+
}
38+
array(2) {
39+
[0]=>
40+
array(3) {
41+
["contents.data"]=>
42+
int(4)
43+
["type.parameters"]=>
44+
array(1) {
45+
["foo"]=>
46+
int(5)
47+
}
48+
["disposition"]=>
49+
array(1) {
50+
["bar"]=>
51+
int(6)
52+
}
53+
}
54+
[1]=>
55+
array(3) {
56+
["contents.data"]=>
57+
int(7)
58+
["type.parameters"]=>
59+
array(1) {
60+
["foo"]=>
61+
int(8)
62+
}
63+
["disposition"]=>
64+
array(1) {
65+
["bar"]=>
66+
int(9)
67+
}
68+
}
69+
}

0 commit comments

Comments
 (0)