MFH:- Fixed bug #45705 (rfc822_parse_adrlist() modifies passed address parameter)

3 files changed, 95 insertions, 14 deletions

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index c2ca39d4ca..b1142b3dd6 100644
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -2527,7 +2527,7 @@ PHP_FUNCTION(imap_rfc822_write_address)
 PHP_FUNCTION(imap_rfc822_parse_adrlist)
 {
 	zval *tovals;
-	char *str, *defaulthost;
+	char *str, *defaulthost, *str_copy;
 	int str_len, defaulthost_len;
 	ADDRESS *addresstmp;
 	ENVELOPE *env;
@@ -2538,7 +2538,10 @@ PHP_FUNCTION(imap_rfc822_parse_adrlist)
 
 	env = mail_newenvelope();
 
-	rfc822_parse_adrlist(&env->to, str, defaulthost);
+	/* rfc822_parse_adrlist() modifies passed string. Copy it. */
+	str_copy = estrndup(str, str_len);
+	rfc822_parse_adrlist(&env->to, str_copy, defaulthost);
+	efree(str_copy);
 
 	array_init(return_value);
 
@@ -3307,53 +3310,58 @@ PHP_FUNCTION(imap_mail_compose)
 	BODY *bod=NULL, *topbod=NULL;
 	PART *mypart=NULL, *part;
 	PARAMETER *param, *disp_param = NULL, *custom_headers_param = NULL, *tmp_param = NULL;
-	char *tmp=NULL, *mystring=NULL, *t=NULL, *tempstring=NULL;
+	char *tmp=NULL, *mystring=NULL, *t=NULL, *tempstring=NULL, *str_copy = NULL;
 	int toppart = 0;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "aa", &envelope, &body) == FAILURE) {
 		return;
 	}
 
+#define PHP_RFC822_PARSE_ADRLIST(target, value) \
+	str_copy = estrndup(Z_STRVAL_PP(value), Z_STRLEN_PP(value)); \
+	rfc822_parse_adrlist(target, str_copy, "NO HOST"); \
+	efree(str_copy);
+
 	env = mail_newenvelope();
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "remail", sizeof("remail"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		env->remail=cpystr(Z_STRVAL_PP(pvalue));
+		env->remail = cpystr(Z_STRVAL_PP(pvalue));
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "return_path", sizeof("return_path"), (void **) &pvalue)== SUCCESS) {
-		convert_to_string_ex(pvalue)
-		rfc822_parse_adrlist(&env->return_path, Z_STRVAL_PP(pvalue), "NO HOST");
+		convert_to_string_ex(pvalue);
+		PHP_RFC822_PARSE_ADRLIST(&env->return_path, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "date", sizeof("date"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		env->date=cpystr(Z_STRVAL_PP(pvalue));
+		env->date = cpystr(Z_STRVAL_PP(pvalue));
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "from", sizeof("from"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		rfc822_parse_adrlist (&env->from, Z_STRVAL_PP(pvalue), "NO HOST");
+		PHP_RFC822_PARSE_ADRLIST(&env->from, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "reply_to", sizeof("reply_to"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		rfc822_parse_adrlist (&env->reply_to, Z_STRVAL_PP(pvalue), "NO HOST");
+		PHP_RFC822_PARSE_ADRLIST(&env->reply_to, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "in_reply_to", sizeof("in_reply_to"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		env->in_reply_to=cpystr(Z_STRVAL_PP(pvalue));
+		env->in_reply_to = cpystr(Z_STRVAL_PP(pvalue));
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "subject", sizeof("subject"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		env->subject=cpystr(Z_STRVAL_PP(pvalue));
+		env->subject = cpystr(Z_STRVAL_PP(pvalue));
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "to", sizeof("to"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		rfc822_parse_adrlist (&env->to, Z_STRVAL_PP(pvalue), "NO HOST");
+		PHP_RFC822_PARSE_ADRLIST(&env->to, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "cc", sizeof("cc"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		rfc822_parse_adrlist (&env->cc, Z_STRVAL_PP(pvalue), "NO HOST");
+		PHP_RFC822_PARSE_ADRLIST(&env->cc, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "bcc", sizeof("bcc"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		rfc822_parse_adrlist (&env->bcc, Z_STRVAL_PP(pvalue), "NO HOST");
+		PHP_RFC822_PARSE_ADRLIST(&env->bcc, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "message_id", sizeof("message_id"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
diff --git a/ext/imap/tests/bug45705_1.phpt b/ext/imap/tests/bug45705_1.phpt
new file mode 100644
index 0000000000..eedaed0817
--- /dev/null
+++ b/ext/imap/tests/bug45705_1.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #45705 test #1 (imap rfc822_parse_adrlist() modifies passed address parameter)
+--SKIPIF--
+<?php
+	if (!extension_loaded("imap")) { 
+		die("skip imap extension not available");  
+	}
+?>
+--FILE--
+<?php
+
+$address = 'John Doe <john@example.com>';
+var_dump($address);
+imap_rfc822_parse_adrlist($address, null);
+var_dump($address);
+
+?>
+--EXPECT--
+string(27) "John Doe <john@example.com>"
+string(27) "John Doe <john@example.com>"
diff --git a/ext/imap/tests/bug45705_2.phpt b/ext/imap/tests/bug45705_2.phpt
new file mode 100644
index 0000000000..797d473178
--- /dev/null
+++ b/ext/imap/tests/bug45705_2.phpt
@@ -0,0 +1,53 @@
+--TEST--
+Bug #45705 test #2 (imap rfc822_parse_adrlist() modifies passed address parameter)
+--SKIPIF--
+<?php
+	if (!extension_loaded("imap")) { 
+		die("skip imap extension not available");  
+	}
+?>
+--FILE--
+<?php
+
+$envelope = array('return_path' => 'John Doe <john@example.com>',
+                  'from'        => 'John Doe <john@example.com>',
+                  'reply_to'    => 'John Doe <john@example.com>',
+                  'to'          => 'John Doe <john@example.com>',
+                  'cc'          => 'John Doe <john@example.com>',
+                  'bcc'         => 'John Doe <john@example.com>',
+);
+
+var_dump($envelope);
+imap_mail_compose($envelope, array(1 => array()));
+var_dump($envelope);
+
+?>
+--EXPECT--
+array(6) {
+  ["return_path"]=>
+  string(27) "John Doe <john@example.com>"
+  ["from"]=>
+  string(27) "John Doe <john@example.com>"
+  ["reply_to"]=>
+  string(27) "John Doe <john@example.com>"
+  ["to"]=>
+  string(27) "John Doe <john@example.com>"
+  ["cc"]=>
+  string(27) "John Doe <john@example.com>"
+  ["bcc"]=>
+  string(27) "John Doe <john@example.com>"
+}
+array(6) {
+  ["return_path"]=>
+  string(27) "John Doe <john@example.com>"
+  ["from"]=>
+  string(27) "John Doe <john@example.com>"
+  ["reply_to"]=>
+  string(27) "John Doe <john@example.com>"
+  ["to"]=>
+  string(27) "John Doe <john@example.com>"
+  ["cc"]=>
+  string(27) "John Doe <john@example.com>"
+  ["bcc"]=>
+  string(27) "John Doe <john@example.com>"
+}