From d9253f7424f35b6736866477896700e419e2edd9 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Wed, 2 Apr 2008 16:26:39 +0000 Subject: Fixed bug #44613 (Crash inside imap_headerinfo()) --- ext/imap/php_imap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'ext/imap/php_imap.c') diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c index 974c23fab5..bd7a272c65 100644 --- a/ext/imap/php_imap.c +++ b/ext/imap/php_imap.c @@ -1593,8 +1593,8 @@ PHP_FUNCTION(imap_headerinfo) convert_to_long_ex(msgno); if (myargc >= 3) { convert_to_long_ex(fromlength); - if (Z_LVAL_PP(fromlength) < 0) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "From length has to be greater than or equal to 0"); + if (Z_LVAL_PP(fromlength) < 0 || Z_LVAL_PP(fromlength) >= MAILTMPLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "From length has to be between 1 and %i", MAILTMPLEN); RETURN_FALSE; } } else { @@ -1602,8 +1602,8 @@ PHP_FUNCTION(imap_headerinfo) } if (myargc >= 4) { convert_to_long_ex(subjectlength); - if (Z_LVAL_PP(subjectlength) < 0) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Subject length has to be greater than or equal to 0"); + if (Z_LVAL_PP(subjectlength) < 0 || Z_LVAL_PP(subjectlength) >= MAILTMPLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Subject length has to be between 1 and %i", MAILTMPLEN); RETURN_FALSE; } } else { -- cgit v1.2.1