@- Fixed bug in imap_compose_mail() which caused crashes. (Jani)

# This one was only partly ported from php3. As some user pointed it out,
# it was working in 3.0.x. But this needs further hacking. Some error
# handlers, at least. Fixes bugs #3337 and #5084.

1 files changed, 105 insertions, 37 deletions

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index e1936a2938..ee9f29678d 100644
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -21,6 +21,7 @@
    |          Chuck Hagenbuch     <chuck@horde.org>                       |
    |          Andrew Skalski      <askalski@chekinc.com>                  |
    |          Hartmut Holzgraefe  <hartmut@six.de>                        |
+   |          Jani Taskinen       <sniper@iki.fi>                         |
    | PHP 4.0 updates:  Zeev Suraski <zeev@zend.com>                       |
    +----------------------------------------------------------------------+
  */
@@ -3006,14 +3007,22 @@ PHP_FUNCTION(imap_mail_compose)
 	PART *mypart=NULL, *toppart=NULL, *part;
 	PARAMETER *param;
 	char tmp[8*MAILTMPLEN], *mystring=NULL, *t, *tempstring;
-	
 	int myargc = ZEND_NUM_ARGS();
+
 	if (myargc != 2 || zend_get_parameters_ex(myargc, &envelope, &body) == FAILURE) {
 		ZEND_WRONG_PARAM_COUNT();
 	}
-	
-	convert_to_writable_array_ex(envelope);
-	convert_to_writable_array_ex(body);
+
+	if ((*envelope)->type != IS_ARRAY) {
+		php_error(E_WARNING, "IMAP: Expected Array as envelope parameter");
+		RETURN_FALSE;
+ 	}
+
+	if ((*body)->type != IS_ARRAY) {
+		php_error(E_WARNING, "IMAP: Expected Array as body parameter");
+		RETURN_FALSE;
+ 	}
+                                                                                        	
 	env=mail_newenvelope();
 	if (zend_hash_find(Z_ARRVAL_PP(envelope), "remail", sizeof("remail"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
@@ -3051,16 +3060,67 @@ PHP_FUNCTION(imap_mail_compose)
 		convert_to_string_ex(pvalue);
 		env->message_id=cpystr(Z_STRVAL_PP(pvalue));
 	}
- 
+
 	zend_hash_internal_pointer_reset(Z_ARRVAL_PP(body));
-	for (;;) {
-		if (zend_hash_get_current_data(Z_ARRVAL_PP(body), (void **) &data)==FAILURE) {
-			break;
+	zend_hash_get_current_data(Z_ARRVAL_PP(body), (void **) &data);
+	zend_hash_get_current_key(Z_ARRVAL_PP(body), &key, &ind);
+
+	if (Z_TYPE_PP(data) == IS_ARRAY) {
+		bod=mail_newbody();
+		topbod=bod;
+
+		if (zend_hash_find(Z_ARRVAL_PP(data), "type", sizeof("type"), (void **) &pvalue)== SUCCESS) {
+			convert_to_long_ex(pvalue);
+			bod->type = (short) Z_LVAL_PP(pvalue);
+		}
+		if (zend_hash_find(Z_ARRVAL_PP(data), "encoding", sizeof("encoding"), (void **) &pvalue)== SUCCESS) {
+			convert_to_long_ex(pvalue);
+			bod->encoding = (short) Z_LVAL_PP(pvalue);
+		}
+		if (zend_hash_find(Z_ARRVAL_PP(data), "subtype", sizeof("subtype"), (void **) &pvalue)== SUCCESS) {
+			convert_to_string_ex(pvalue);
+			bod->subtype = cpystr(Z_STRVAL_PP(pvalue));
+		}
+		if (zend_hash_find(Z_ARRVAL_PP(data), "id", sizeof("id"), (void **) &pvalue)== SUCCESS) {
+			convert_to_string_ex(pvalue);
+			bod->id = cpystr(Z_STRVAL_PP(pvalue));
+		}
+		if (zend_hash_find(Z_ARRVAL_PP(data), "contents.data", sizeof("contents.data"), (void **) &pvalue)== SUCCESS) {
+			convert_to_string_ex(pvalue);
+			bod->contents.text.data = (char *) fs_get(Z_STRLEN_PP(pvalue));
+			memcpy(bod->contents.text.data, Z_STRVAL_PP(pvalue), Z_STRLEN_PP(pvalue)+1);
+			bod->contents.text.size = Z_STRLEN_PP(pvalue);
 		}
-		zend_hash_get_current_key(Z_ARRVAL_PP(body), &key, &ind);
+		if (zend_hash_find(Z_ARRVAL_PP(data), "lines", sizeof("lines"), (void **) &pvalue)== SUCCESS) {
+			convert_to_long_ex(pvalue);
+			bod->size.lines = Z_LVAL_PP(pvalue);
+		}
+		if (zend_hash_find(Z_ARRVAL_PP(data), "bytes", sizeof("bytes"), (void **) &pvalue)== SUCCESS) {
+			convert_to_long_ex(pvalue);
+			bod->size.bytes = Z_LVAL_PP(pvalue);
+		}
+		if (zend_hash_find(Z_ARRVAL_PP(data), "md5", sizeof("md5"), (void **) &pvalue)== SUCCESS) {
+			convert_to_string_ex(pvalue);
+			bod->md5 = cpystr(Z_STRVAL_PP(pvalue));
+		}
+	}
+
+ 	zend_hash_move_forward(Z_ARRVAL_PP(body));
+
+	while(zend_hash_get_current_data(Z_ARRVAL_PP(body), (void **) &data) == SUCCESS) { 
+		zend_hash_get_current_key(Z_ARRVAL_PP(body), &key, &ind); 
 		if (Z_TYPE_PP(data) == IS_ARRAY) {
-			bod=mail_newbody();
-			topbod=bod;
+			if (!toppart) {
+				bod->nested.part=mail_newbody_part();
+				mypart=bod->nested.part;
+				toppart=mypart;
+				bod=&mypart->body;
+			} else {
+				 mypart->next=mail_newbody_part();
+				 mypart=mypart->next;
+				 bod=&mypart->body;
+			}
+
 			if (zend_hash_find(Z_ARRVAL_PP(data), "type", sizeof("type"), (void **) &pvalue)== SUCCESS) {
 				convert_to_long_ex(pvalue);
 				bod->type = (short) Z_LVAL_PP(pvalue);
@@ -3071,7 +3131,7 @@ PHP_FUNCTION(imap_mail_compose)
 			}
 			if (zend_hash_find(Z_ARRVAL_PP(data), "subtype", sizeof("subtype"), (void **) &pvalue)== SUCCESS) {
 				convert_to_string_ex(pvalue);
-				bod->subtype = cpystr(Z_STRVAL_PP(pvalue));
+				bod->subtype = cpystr(Z_STRVAL_PP(pvalue));	
 			}
 			if (zend_hash_find(Z_ARRVAL_PP(data), "id", sizeof("id"), (void **) &pvalue)== SUCCESS) {
 				convert_to_string_ex(pvalue);
@@ -3095,17 +3155,8 @@ PHP_FUNCTION(imap_mail_compose)
 				convert_to_string_ex(pvalue);
 				bod->md5 = cpystr(Z_STRVAL_PP(pvalue));
 			}
-		}
-		zend_hash_move_forward(Z_ARRVAL_PP(body));
-		if (!toppart) {
-			bod->nested.part=mail_newbody_part();
-			mypart=bod->nested.part;
-			toppart=mypart;
-			bod=&mypart->body;
-		} else {
-			 mypart->next=mail_newbody_part();
-			 mypart=mypart->next;
-			 bod=&mypart->body;
+
+			zend_hash_move_forward(Z_ARRVAL_PP(body));
 		}
 	}
 
@@ -3115,25 +3166,36 @@ PHP_FUNCTION(imap_mail_compose)
 	strcpy(mystring, tmp);
 
 	bod=topbod;
-	switch (bod->type) {
-		case TYPEMULTIPART:           /* multipart gets special handling */
-			part = bod->nested.part;   /* first body part */
-										/* find cookie */
+
+	if (bod && bod->type == TYPEMULTIPART) {	
+
+		/* first body part */
+			part = bod->nested.part;	
+
+		/* find cookie */
 			for (param = bod->parameter; param && !cookie; param = param->next) {
 				if (!strcmp (param->attribute, "BOUNDARY")) {
 					cookie = param->value;
 				}
 			}
+
+		/* yucky default */
 			if (!cookie) {
-				cookie = "-";  /* yucky default */
+				cookie = "-";  
 			}
-			do {                        /* for each part */
-                    /* build cookie */
+
+		/* for each part */
+			do {
+			/* build cookie */
 				sprintf (t=tmp, "--%s\015\012", cookie);
-										/* append mini-header */
+
+			/* append mini-header */
 				rfc822_write_body_header(&t, &part->body);
-				strcat (t, "\015\012");    /* write terminating blank line */
-										/* output cookie, mini-header, and contents */
+
+			/* write terminating blank line */
+				strcat (t, "\015\012");    
+
+			/* output cookie, mini-header, and contents */
 				tempstring=emalloc(strlen(mystring)+strlen(tmp)+1);
 				strcpy(tempstring,mystring);
 				efree(mystring);
@@ -3157,17 +3219,23 @@ PHP_FUNCTION(imap_mail_compose)
 			efree(mystring);
 			mystring=tempstring;
 			strcat(mystring,tmp);
-			break;
-		default:                      /* all else is text now */
+
+	} else if(bod) {
+
 			tempstring=emalloc(strlen(bod->contents.text.data)+strlen(mystring)+1);
 			strcpy(tempstring,mystring);
 			efree(mystring);
 			mystring=tempstring;
 			strcat(mystring, bod->contents.text.data);
-			break;
+
+	} else {
+		efree(mystring);
+		RETURN_FALSE;
 	}
 
-	RETURN_STRINGL(mystring,strlen(mystring), 1);  
+	RETVAL_STRINGL(mystring,strlen(mystring), 1);  
+	efree(tempstring);
+
 }
 /* }}} */