diff options
author | Stanislav Malyshev <stas@php.net> | 2019-04-29 22:09:04 -0700 |
---|---|---|
committer | Remi Collet <remi@php.net> | 2019-04-30 09:52:10 +0200 |
commit | 7156f28e750653d651ec5e8c9eef66168006c129 (patch) | |
tree | 9091f8f80e2ade3c7230988d6150ab09ab43c4a4 | |
parent | 4e17b44b2870a86afeb61fc92d88c945ad94a0a8 (diff) | |
download | php-git-7156f28e750653d651ec5e8c9eef66168006c129.tar.gz |
Merge branch 'PHP-7.1' into PHP-7.2
* PHP-7.1:
Fix #77821: Potential heap corruption in TSendMail()
-rw-r--r-- | win32/sendmail.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/win32/sendmail.c b/win32/sendmail.c index 62d710589d..c171eba950 100644 --- a/win32/sendmail.c +++ b/win32/sendmail.c @@ -261,8 +261,9 @@ PHPAPI int TSendMail(char *host, int *error, char **error_message, } if (!found) { - if (headers_lc) { - zend_string_free(headers_lc); + if (headers) { + zend_string_release(headers_trim); + zend_string_release(headers_lc); } *error = W32_SM_SENDMAIL_FROM_NOT_SET; return FAILURE; @@ -276,8 +277,8 @@ PHPAPI int TSendMail(char *host, int *error, char **error_message, efree(RPath); } if (headers) { - zend_string_free(headers_trim); - zend_string_free(headers_lc); + zend_string_release(headers_trim); + zend_string_release(headers_lc); } /* 128 is safe here, the specifier in snprintf isn't longer than that */ *error_message = ecalloc(1, HOST_NAME_LEN + 128); @@ -293,8 +294,8 @@ PHPAPI int TSendMail(char *host, int *error, char **error_message, efree(RPath); } if (headers) { - zend_string_free(headers_trim); - zend_string_free(headers_lc); + zend_string_release(headers_trim); + zend_string_release(headers_lc); } if (ret != SUCCESS) { *error = ret; |