Skip to content

Commit 9e95056

Browse files
committed
Merge branch 'PHP-8.0' into master
* PHP-8.0: Fix #80242: imap_mail_compose() segfaults for multipart with rfc822
2 parents d7a16bf + edd8bd6 commit 9e95056

File tree

2 files changed

+35
-9
lines changed

2 files changed

+35
-9
lines changed

ext/imap/php_imap.c

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3375,15 +3375,19 @@ PHP_FUNCTION(imap_mail_compose)
33753375
bod->disposition.parameter = disp_param;
33763376
}
33773377
}
3378-
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "contents.data", sizeof("contents.data") - 1)) != NULL) {
3379-
convert_to_string_ex(pvalue);
3380-
bod->contents.text.data = fs_get(Z_STRLEN_P(pvalue) + 1);
3381-
memcpy(bod->contents.text.data, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue) + 1);
3382-
bod->contents.text.size = Z_STRLEN_P(pvalue);
3378+
if (bod->type == TYPEMESSAGE && bod->subtype && !strcmp(bod->subtype, "RFC822")) {
3379+
bod->nested.msg = mail_newmsg();
33833380
} else {
3384-
bod->contents.text.data = fs_get(1);
3385-
memcpy(bod->contents.text.data, "", 1);
3386-
bod->contents.text.size = 0;
3381+
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "contents.data", sizeof("contents.data") - 1)) != NULL) {
3382+
convert_to_string_ex(pvalue);
3383+
bod->contents.text.data = fs_get(Z_STRLEN_P(pvalue) + 1);
3384+
memcpy(bod->contents.text.data, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue) + 1);
3385+
bod->contents.text.size = Z_STRLEN_P(pvalue);
3386+
} else {
3387+
bod->contents.text.data = fs_get(1);
3388+
memcpy(bod->contents.text.data, "", 1);
3389+
bod->contents.text.size = 0;
3390+
}
33873391
}
33883392
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "lines", sizeof("lines") - 1)) != NULL) {
33893393
bod->size.lines = zval_get_long(pvalue);
@@ -3485,7 +3489,7 @@ PHP_FUNCTION(imap_mail_compose)
34853489

34863490
bod=&part->body;
34873491

3488-
spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data, CRLF);
3492+
spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data ? (char *) bod->contents.text.data : "", CRLF);
34893493
efree(mystring);
34903494
mystring=tempstring;
34913495
} while ((part = part->next)); /* until done */

ext/imap/tests/bug80242.phpt

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--TEST--
2+
Bug #80242 (imap_mail_compose() segfaults for multipart with rfc822)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('imap')) die('skip imap extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
$bodies = [[
10+
'type' => TYPEMULTIPART,
11+
], [
12+
'type' => TYPETEXT,
13+
'contents.data' => 'some text',
14+
], [
15+
'type' => TYPEMESSAGE,
16+
'subtype' => 'RFC822',
17+
]];
18+
imap_mail_compose([], $bodies);
19+
echo "done\n";
20+
?>
21+
--EXPECT--
22+
done

0 commit comments

Comments
 (0)