Fixed bug #35669 (imap_mail_compose() crashes with

multipart-multiboundary-email).

1 files changed, 17 insertions, 18 deletions

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 1e17bd1055..967b9be635 100644
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -2837,9 +2837,10 @@ PHP_FUNCTION(imap_mail_compose)
 	char *cookie = NIL;
 	ENVELOPE *env;
 	BODY *bod=NULL, *topbod=NULL;
-	PART *mypart=NULL, *toppart=NULL, *part;
+	PART *mypart=NULL, *part;
 	PARAMETER *param, *disp_param = NULL, *custom_headers_param = NULL, *tmp_param = NULL;
 	char tmp[8 * MAILTMPLEN], *mystring=NULL, *t=NULL, *tempstring=NULL;
+	int toppart = 0;
 
 	if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &envelope, &body) == FAILURE) {
 		ZEND_WRONG_PARAM_COUNT();
@@ -2922,7 +2923,6 @@ PHP_FUNCTION(imap_mail_compose)
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "body parameter cannot be empty");
 		RETURN_FALSE;
 	}
-	zend_hash_get_current_key(Z_ARRVAL_PP(body), &key, &ind, 0); /* FIXME: is this necessary?  we're not using key/ind */
 
 	if (Z_TYPE_PP(data) == IS_ARRAY) {
 		bod = mail_newbody();
@@ -3022,23 +3022,28 @@ PHP_FUNCTION(imap_mail_compose)
  	zend_hash_move_forward(Z_ARRVAL_PP(body));
 
 	while (zend_hash_get_current_data(Z_ARRVAL_PP(body), (void **) &data) == SUCCESS) {
-		zend_hash_get_current_key(Z_ARRVAL_PP(body), &key, &ind, 0);  /* FIXME: Is this necessary?  We're not using key/ind */
 		if (Z_TYPE_PP(data) == IS_ARRAY) {
+			short type = -1;
+			if (zend_hash_find(Z_ARRVAL_PP(data), "type", sizeof("type"), (void **) &pvalue)== SUCCESS) {
+				convert_to_long_ex(pvalue);
+				type = (short) Z_LVAL_PP(pvalue);
+			}
+
 			if (!toppart) {
 				bod->nested.part = mail_newbody_part();
 				mypart = bod->nested.part;
-				toppart = mypart;
-				bod=&mypart->body;
+				toppart = 1;
 			} else {
-				 mypart->next = mail_newbody_part();
-				 mypart = mypart->next;
-				 bod = &mypart->body;
+				mypart->next = mail_newbody_part();
+				mypart = mypart->next;
 			}
 
-			if (zend_hash_find(Z_ARRVAL_PP(data), "type", sizeof("type"), (void **) &pvalue)== SUCCESS) {
-				convert_to_long_ex(pvalue);
-				bod->type = (short) Z_LVAL_PP(pvalue);
-			}
+			bod = &mypart->body;
+
+			if (type != TYPEMULTIPART) {
+				bod->type = type;
+			}			
+
 			if (zend_hash_find(Z_ARRVAL_PP(data), "encoding", sizeof("encoding"), (void **) &pvalue)== SUCCESS) {
 				convert_to_long_ex(pvalue);
 				bod->encoding = (short) Z_LVAL_PP(pvalue);
@@ -3135,12 +3140,6 @@ PHP_FUNCTION(imap_mail_compose)
 		goto done;
 	}
 
-	if (bod && bod->type == TYPEMULTIPART && (!bod->nested.part || !bod->nested.part->next)) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot generate multipart e-mail without components.");
-		RETVAL_FALSE;
-		goto done;
-	}
-
 	rfc822_encode_body_7bit(env, topbod); 
 	rfc822_header (tmp, env, topbod);