diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2020-10-12 10:36:18 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-10-12 13:31:30 +0200 |
| commit | 0d022ddf03c5fabaaa22e486d1e4a367ed9170a7 (patch) | |
| tree | 0d5e12762f3ab8fbaa1273578028b9012c6cada2 | |
| parent | 3c4dd73c023e4aea317f774e045fdccc644f24b5 (diff) | |
| download | php-git-0d022ddf03c5fabaaa22e486d1e4a367ed9170a7.tar.gz | |
Fix #80220: imap_mail_compose() may leak memory
Unless `topbod` is of `TYPEMULTIPART`, `mail_free_body()` does not free
the `nested.part`; while we could do this ourselves, instead we just
ignore additional bodies in this case, i.e. we don't attach them in the
first place.
Closes GH-6321.
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | ext/imap/php_imap.c | 2 |
2 files changed, 2 insertions, 1 deletions
@@ -12,6 +12,7 @@ PHP NEWS - IMAP: . Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies). (cmb) . Fixed bug #80215 (imap_mail_compose() may modify by-val parameters). (cmb) + . Fixed bug #80220 (imap_mail_compose() may leak memory). (cmb) - MySQLnd: . Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c index 7901777f81..0cf350e907 100644 --- a/ext/imap/php_imap.c +++ b/ext/imap/php_imap.c @@ -3714,7 +3714,7 @@ PHP_FUNCTION(imap_mail_compose) convert_to_string_ex(pvalue); bod->md5 = cpystr(Z_STRVAL_P(pvalue)); } - } else if (Z_TYPE_P(data) == IS_ARRAY) { + } else if (Z_TYPE_P(data) == IS_ARRAY && topbod->type == TYPEMULTIPART) { short type = -1; SEPARATE_ARRAY(data); if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type", sizeof("type") - 1)) != NULL) { |