1 files changed, 22 insertions, 14 deletions

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index c2ca39d4ca..b1142b3dd6 100644
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -2527,7 +2527,7 @@ PHP_FUNCTION(imap_rfc822_write_address)
 PHP_FUNCTION(imap_rfc822_parse_adrlist)
 {
 	zval *tovals;
-	char *str, *defaulthost;
+	char *str, *defaulthost, *str_copy;
 	int str_len, defaulthost_len;
 	ADDRESS *addresstmp;
 	ENVELOPE *env;
@@ -2538,7 +2538,10 @@ PHP_FUNCTION(imap_rfc822_parse_adrlist)
 
 	env = mail_newenvelope();
 
-	rfc822_parse_adrlist(&env->to, str, defaulthost);
+	/* rfc822_parse_adrlist() modifies passed string. Copy it. */
+	str_copy = estrndup(str, str_len);
+	rfc822_parse_adrlist(&env->to, str_copy, defaulthost);
+	efree(str_copy);
 
 	array_init(return_value);
 
@@ -3307,53 +3310,58 @@ PHP_FUNCTION(imap_mail_compose)
 	BODY *bod=NULL, *topbod=NULL;
 	PART *mypart=NULL, *part;
 	PARAMETER *param, *disp_param = NULL, *custom_headers_param = NULL, *tmp_param = NULL;
-	char *tmp=NULL, *mystring=NULL, *t=NULL, *tempstring=NULL;
+	char *tmp=NULL, *mystring=NULL, *t=NULL, *tempstring=NULL, *str_copy = NULL;
 	int toppart = 0;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "aa", &envelope, &body) == FAILURE) {
 		return;
 	}
 
+#define PHP_RFC822_PARSE_ADRLIST(target, value) \
+	str_copy = estrndup(Z_STRVAL_PP(value), Z_STRLEN_PP(value)); \
+	rfc822_parse_adrlist(target, str_copy, "NO HOST"); \
+	efree(str_copy);
+
 	env = mail_newenvelope();
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "remail", sizeof("remail"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		env->remail=cpystr(Z_STRVAL_PP(pvalue));
+		env->remail = cpystr(Z_STRVAL_PP(pvalue));
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "return_path", sizeof("return_path"), (void **) &pvalue)== SUCCESS) {
-		convert_to_string_ex(pvalue)
-		rfc822_parse_adrlist(&env->return_path, Z_STRVAL_PP(pvalue), "NO HOST");
+		convert_to_string_ex(pvalue);
+		PHP_RFC822_PARSE_ADRLIST(&env->return_path, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "date", sizeof("date"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		env->date=cpystr(Z_STRVAL_PP(pvalue));
+		env->date = cpystr(Z_STRVAL_PP(pvalue));
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "from", sizeof("from"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		rfc822_parse_adrlist (&env->from, Z_STRVAL_PP(pvalue), "NO HOST");
+		PHP_RFC822_PARSE_ADRLIST(&env->from, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "reply_to", sizeof("reply_to"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		rfc822_parse_adrlist (&env->reply_to, Z_STRVAL_PP(pvalue), "NO HOST");
+		PHP_RFC822_PARSE_ADRLIST(&env->reply_to, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "in_reply_to", sizeof("in_reply_to"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		env->in_reply_to=cpystr(Z_STRVAL_PP(pvalue));
+		env->in_reply_to = cpystr(Z_STRVAL_PP(pvalue));
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "subject", sizeof("subject"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		env->subject=cpystr(Z_STRVAL_PP(pvalue));
+		env->subject = cpystr(Z_STRVAL_PP(pvalue));
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "to", sizeof("to"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		rfc822_parse_adrlist (&env->to, Z_STRVAL_PP(pvalue), "NO HOST");
+		PHP_RFC822_PARSE_ADRLIST(&env->to, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "cc", sizeof("cc"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		rfc822_parse_adrlist (&env->cc, Z_STRVAL_PP(pvalue), "NO HOST");
+		PHP_RFC822_PARSE_ADRLIST(&env->cc, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "bcc", sizeof("bcc"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
-		rfc822_parse_adrlist (&env->bcc, Z_STRVAL_PP(pvalue), "NO HOST");
+		PHP_RFC822_PARSE_ADRLIST(&env->bcc, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "message_id", sizeof("message_id"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);