From ddbb21e36c349c9fcae4000837a56d3a3eb28542 Mon Sep 17 00:00:00 2001 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com> Date: Sat, 1 Apr 2023 15:02:30 +0200 Subject: [PATCH] Fix GH-10990: mail() throws TypeError after iterating over $additional_headers array by reference We should dereference the values, otherwise references don't work. --- ext/standard/mail.c | 2 ++ ext/standard/tests/mail/gh10990.phpt | 17 +++++++++++++++++ 2 files changed, 19 insertions(+) create mode 100644 ext/standard/tests/mail/gh10990.phpt diff --git a/ext/standard/mail.c b/ext/standard/mail.c index 003fad3ea18c5..4299c10bc2e8e 100644 --- a/ext/standard/mail.c +++ b/ext/standard/mail.c @@ -136,6 +136,7 @@ static void php_mail_build_headers_elems(smart_str *s, zend_string *key, zval *v zend_type_error("Header \"%s\" must only contain numeric keys, \"%s\" found", ZSTR_VAL(key), ZSTR_VAL(tmp_key)); break; } + ZVAL_DEREF(tmp_val); if (Z_TYPE_P(tmp_val) != IS_STRING) { zend_type_error("Header \"%s\" must only contain values of type string, %s found", ZSTR_VAL(key), zend_zval_type_name(tmp_val)); break; @@ -157,6 +158,7 @@ PHPAPI zend_string *php_mail_build_headers(HashTable *headers) zend_type_error("Header name cannot be numeric, " ZEND_LONG_FMT " given", idx); break; } + ZVAL_DEREF(val); /* https://tools.ietf.org/html/rfc2822#section-3.6 */ if (zend_string_equals_literal_ci(key, "orig-date")) { PHP_MAIL_BUILD_HEADER_CHECK("orig-date", s, key, val); diff --git a/ext/standard/tests/mail/gh10990.phpt b/ext/standard/tests/mail/gh10990.phpt new file mode 100644 index 0000000000000..4f74c17c22bda --- /dev/null +++ b/ext/standard/tests/mail/gh10990.phpt @@ -0,0 +1,17 @@ +--TEST-- +GH-10990 (mail() throws TypeError after iterating over $additional_headers array by reference) +--INI-- +sendmail_path=rubbish 2>/dev/null +--SKIPIF-- + +--FILE-- + &$from]; +var_dump(mail('test@example.com', 'Test', 'Test', $headers)); +?> +--EXPECT-- +bool(false)