diff options
| author | George Peter Banyard <girgias@php.net> | 2020-10-22 15:21:57 +0100 |
|---|---|---|
| committer | George Peter Banyard <girgias@php.net> | 2020-10-22 15:50:01 +0100 |
| commit | 8b265fb602b2945b5ba56da2bb206e687ab3bb5b (patch) | |
| tree | ec86785bebee484bd04780ccee84b1cccafbe837 | |
| parent | 6de6f2a4e9e54ce31030973dd11cc0cdaaa5c6bb (diff) | |
| download | php-git-8b265fb602b2945b5ba56da2bb206e687ab3bb5b.tar.gz | |
Fix segfaults after conversion from zval to zend_string params
| -rw-r--r-- | ext/imap/php_imap.c | 18 | ||||
| -rw-r--r-- | ext/imap/tests/bug77020.phpt | 2 |
2 files changed, 15 insertions, 5 deletions
diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c index 258bd5bb9c..6861b2ad9e 100644 --- a/ext/imap/php_imap.c +++ b/ext/imap/php_imap.c @@ -3532,6 +3532,7 @@ bool _php_imap_mail(zend_string *to, zend_string *subject, zend_string *message, ZEND_ASSERT(to && ZSTR_LEN(to) != 0); ZEND_ASSERT(subject && ZSTR_LEN(subject) != 0); + ZEND_ASSERT(message); #ifdef PHP_WIN32 char *tempMailTo; @@ -3661,14 +3662,23 @@ bool _php_imap_mail(zend_string *to, zend_string *subject, zend_string *message, } sendmail = popen(INI_STR("sendmail_path"), "w"); if (sendmail) { - if (ZSTR_LEN(rpath) != 0) fprintf(sendmail, "From: %s\n", ZSTR_VAL(rpath)); + if (rpath && ZSTR_LEN(rpath) != 0) { + fprintf(sendmail, "From: %s\n", ZSTR_VAL(rpath)); + } + /* to cannot be a null pointer, asserted earlier on */ fprintf(sendmail, "To: %s\n", ZSTR_VAL(to)); - if (ZSTR_LEN(cc) != 0) fprintf(sendmail, "Cc: %s\n", ZSTR_VAL(cc)); - if (ZSTR_LEN(bcc) != 0) fprintf(sendmail, "Bcc: %s\n", ZSTR_VAL(bcc)); + if (cc && ZSTR_LEN(cc) != 0) { + fprintf(sendmail, "Cc: %s\n", ZSTR_VAL(cc)); + } + if (bcc && ZSTR_LEN(bcc) != 0) { + fprintf(sendmail, "Bcc: %s\n", ZSTR_VAL(bcc)); + } + /* subject cannot be a null pointer, asserted earlier on */ fprintf(sendmail, "Subject: %s\n", ZSTR_VAL(subject)); - if (headers != NULL) { + if (headers && ZSTR_LEN(headers) != 0) { fprintf(sendmail, "%s\n", ZSTR_VAL(headers)); } + /* message cannot be a null pointer, asserted earlier on */ fprintf(sendmail, "\n%s\n", ZSTR_VAL(message)); ret = pclose(sendmail); diff --git a/ext/imap/tests/bug77020.phpt b/ext/imap/tests/bug77020.phpt index 582b132ad8..43c8133700 100644 --- a/ext/imap/tests/bug77020.phpt +++ b/ext/imap/tests/bug77020.phpt @@ -10,4 +10,4 @@ imap_mail('1', 1, NULL); ?> --EXPECTF-- Warning: imap_mail(): No message string in mail command in %s on line %d -%A +%S |