Fixed bug #22048 (crash in imap_headers when the e-mail contains an

abnormally large number of special characters).

1 files changed, 32 insertions, 4 deletions

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 944f27a16a..e43f513f98 100644
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -3549,6 +3549,34 @@ PHP_FUNCTION(imap_mime_header_decode)
 }
 /* }}} */
 
+/* {{{ _php_rfc822_len
+ * Calculate string length based on imap's rfc822_cat function.
+ */	
+static int _php_rfc822_len(char *str)
+{
+	int len;
+	char *p;
+
+	if (!str || !*str) {
+		return 0;
+	}
+
+	/* strings with special characters will need to be quoted, as a safety measure we
+	 * add 2 bytes for the quotes just in case.
+	 */
+	len = strlen(str) + 2;
+	p = str;
+	/* rfc822_cat() will escape all " and \ characters, therefor we need to increase
+	 * our buffer length to account for these characters.
+	 */
+	while ((p = strpbrk(p, "\\\""))) {
+		p++;
+		len++;
+	}
+
+	return len;
+}
+/* }}} */
 
 /* Support Functions */
 /* {{{ _php_imap_get_address_size
@@ -3561,10 +3589,10 @@ static int _php_imap_address_size (ADDRESS *addresslist)
 	tmp = addresslist;
 
 	if (tmp) do {
-		ret += (tmp->personal) ? strlen(tmp->personal) : 0;
-		ret += (tmp->adl)      ? strlen(tmp->adl)      : 0;
-		ret += (tmp->mailbox)  ? strlen(tmp->mailbox)  : 0;
-		ret += (tmp->host)     ? strlen(tmp->host)     : 0;
+		ret += _php_rfc822_len(tmp->personal);
+		ret += _php_rfc822_len(tmp->adl);
+		ret += _php_rfc822_len(tmp->mailbox);
+		ret += _php_rfc822_len(tmp->host);
 		num_ent++;
 	} while ((tmp = tmp->next));