diff options
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/imap/php_imap.c | 4 | ||||
| -rw-r--r-- | ext/imap/tests/bug80213.phpt | 21 |
3 files changed, 28 insertions, 0 deletions
@@ -6,6 +6,9 @@ PHP NEWS . Fixed bug #80121 (Null pointer deref if CurlHandle directly instantiated). (Nikita) +- IMAP: + . Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies). (cmb) + - Opcache: . Fixed bug #80184 (Complex expression in while / if statements resolves to false incorrectly). (Nikita) diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c index 88ce679f3a..13c7bef42a 100644 --- a/ext/imap/php_imap.c +++ b/ext/imap/php_imap.c @@ -3195,6 +3195,7 @@ PHP_FUNCTION(imap_mail_compose) if(Z_TYPE_P(pvalue) == IS_ARRAY) { disp_param = tmp_param = NULL; ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) { + if (key == NULL) continue; disp_param = mail_newbody_parameter(); disp_param->attribute = cpystr(ZSTR_VAL(key)); convert_to_string_ex(disp_data); @@ -3227,6 +3228,7 @@ PHP_FUNCTION(imap_mail_compose) if (Z_TYPE_P(pvalue) == IS_ARRAY) { disp_param = tmp_param = NULL; ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) { + if (key == NULL) continue; disp_param = mail_newbody_parameter(); disp_param->attribute = cpystr(ZSTR_VAL(key)); convert_to_string_ex(disp_data); @@ -3295,6 +3297,7 @@ PHP_FUNCTION(imap_mail_compose) if (Z_TYPE_P(pvalue) == IS_ARRAY) { disp_param = tmp_param = NULL; ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) { + if (key == NULL) continue; disp_param = mail_newbody_parameter(); disp_param->attribute = cpystr(ZSTR_VAL(key)); convert_to_string_ex(disp_data); @@ -3327,6 +3330,7 @@ PHP_FUNCTION(imap_mail_compose) if (Z_TYPE_P(pvalue) == IS_ARRAY) { disp_param = tmp_param = NULL; ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) { + if (key == NULL) continue; disp_param = mail_newbody_parameter(); disp_param->attribute = cpystr(ZSTR_VAL(key)); convert_to_string_ex(disp_data); diff --git a/ext/imap/tests/bug80213.phpt b/ext/imap/tests/bug80213.phpt new file mode 100644 index 0000000000..9a7961df77 --- /dev/null +++ b/ext/imap/tests/bug80213.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #80213 (imap_mail_compose() segfaults on certain $bodies) +--SKIPIF-- +<?php +if (!extension_loaded('imap')) die('skip imap extension not available'); +?> +--FILE-- +<?php +$envelope = []; +$body = [[ + 'type.parameters' => ['param'], + 'disposition' => ['disp'], +], [ + 'type.parameters' => ['param'], + 'disposition' => ['disp'], +]]; +imap_mail_compose($envelope, $body); +echo "done\n"; +?> +--EXPECT-- +done |