From 315b95b0654fca116d6db0f11dc22151ac139988 Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Tue, 20 Oct 2020 16:38:16 +0200 Subject: Fix #80242: imap_mail_compose() segfaults for multipart with rfc822 libc-client expects `TYPEMESSAGE` with an explicit subtype of `RFC822` to have a `nested.msg` (otherwise there will be a segfault during free), but not to have any `contents.text.data` (this will leak otherwise). Closes GH-6345. --- ext/imap/php_imap.c | 22 +++++++++++++--------- ext/imap/tests/bug80242.phpt | 22 ++++++++++++++++++++++ 2 files changed, 35 insertions(+), 9 deletions(-) create mode 100644 ext/imap/tests/bug80242.phpt (limited to 'ext/imap') diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c index 7d0fca1e98..cf8ed7bcf2 100644 --- a/ext/imap/php_imap.c +++ b/ext/imap/php_imap.c @@ -3818,15 +3818,19 @@ PHP_FUNCTION(imap_mail_compose) bod->disposition.parameter = disp_param; } } - if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "contents.data", sizeof("contents.data") - 1)) != NULL) { - convert_to_string_ex(pvalue); - bod->contents.text.data = fs_get(Z_STRLEN_P(pvalue) + 1); - memcpy(bod->contents.text.data, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue) + 1); - bod->contents.text.size = Z_STRLEN_P(pvalue); + if (bod->type == TYPEMESSAGE && bod->subtype && !strcmp(bod->subtype, "RFC822")) { + bod->nested.msg = mail_newmsg(); } else { - bod->contents.text.data = fs_get(1); - memcpy(bod->contents.text.data, "", 1); - bod->contents.text.size = 0; + if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "contents.data", sizeof("contents.data") - 1)) != NULL) { + convert_to_string_ex(pvalue); + bod->contents.text.data = fs_get(Z_STRLEN_P(pvalue) + 1); + memcpy(bod->contents.text.data, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue) + 1); + bod->contents.text.size = Z_STRLEN_P(pvalue); + } else { + bod->contents.text.data = fs_get(1); + memcpy(bod->contents.text.data, "", 1); + bod->contents.text.size = 0; + } } if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "lines", sizeof("lines") - 1)) != NULL) { bod->size.lines = zval_get_long(pvalue); @@ -3927,7 +3931,7 @@ PHP_FUNCTION(imap_mail_compose) bod=&part->body; - spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data, CRLF); + spprintf(&tempstring, 0, "%s%s%s", mystring, bod->contents.text.data ? (char *) bod->contents.text.data : "", CRLF); efree(mystring); mystring=tempstring; } while ((part = part->next)); /* until done */ diff --git a/ext/imap/tests/bug80242.phpt b/ext/imap/tests/bug80242.phpt new file mode 100644 index 0000000000..849e7c6212 --- /dev/null +++ b/ext/imap/tests/bug80242.phpt @@ -0,0 +1,22 @@ +--TEST-- +Bug #80242 (imap_mail_compose() segfaults for multipart with rfc822) +--SKIPIF-- + +--FILE-- + TYPEMULTIPART, +], [ + 'type' => TYPETEXT, + 'contents.data' => 'some text', +], [ + 'type' => TYPEMESSAGE, + 'subtype' => 'RFC822', +]]; +imap_mail_compose([], $bodies); +echo "done\n"; +?> +--EXPECT-- +done -- cgit v1.2.1