From 8488c34fc607353be97e0ebadca3fec9f6373b6d Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Mon, 12 Oct 2020 18:06:53 +0200
Subject: Fix #80226: imap_sort() leaks sortpgm memory

We need to free what we have allocated.

Closes GH-6327.
---
 NEWS                         |  1 +
 ext/imap/php_imap.c          |  1 +
 ext/imap/tests/bug80226.phpt | 13 +++++++++++++
 3 files changed, 15 insertions(+)
 create mode 100644 ext/imap/tests/bug80226.phpt

diff --git a/NEWS b/NEWS
index 6e1a2f7857..0a8d47737c 100644
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,7 @@ PHP                                                                        NEWS
     (cmb)
   . Fixed bug #80216 (imap_mail_compose() does not validate types/encodings).
     (cmb)
+  . Fixed bug #80226 (imap_sort() leaks sortpgm memory). (cmb)
 
 - MySQLnd:
   . Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with
diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 5f05a0c359..a88c329b01 100644
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -3189,6 +3189,7 @@ PHP_FUNCTION(imap_sort)
 
 	slst = mail_sort(imap_le_struct->imap_stream, (argc == 6 ? ZSTR_VAL(charset) : NIL), spg, mypgm, (argc >= 4 ? flags : NIL));
 
+	mail_free_sortpgm(&mypgm);
 	if (spg && !(flags & SE_FREE)) {
 		mail_free_searchpgm(&spg);
 	}
diff --git a/ext/imap/tests/bug80226.phpt b/ext/imap/tests/bug80226.phpt
new file mode 100644
index 0000000000..95ec235178
--- /dev/null
+++ b/ext/imap/tests/bug80226.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #80226 (imap_sort() leaks sortpgm memory)
+--SKIPIF--
+<?php
+require_once(__DIR__.'/skipif.inc');
+?>
+--FILE--
+<?php
+require_once(__DIR__.'/imap_include.inc');
+$stream = imap_open($default_mailbox, $username, $password);
+imap_sort($stream, SORTFROM, 0);
+?>
+--EXPECT--
-- 
cgit v1.2.1