MFH: Fixed bug #24150 (crash in imap_fetch_overview() &

imap_rfc822_write_address())

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 069c69557c93b95defebc82343f9ef2ea86028c9..0ad60d0a264f888f08fd15cdefaa63f8ae895b68 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -1955,6 +1955,10 @@ PHP_FUNCTION(imap_rfc822_write_address)
        addr->error=NIL;
        addr->adl=NIL;
 
+       if (_php_imap_address_size(addr) >= MAILTMPLEN) {
+               RETURN_FALSE;
+       }
+
        string[0]='\0';
        rfc822_write_address(string, addr);
        RETVAL_STRING(string, 1);
@@ -2715,13 +2719,13 @@ PHP_FUNCTION(imap_fetch_overview)
                                if (env->subject) {
                                        add_property_string(myoverview, "subject", env->subject, 1);
                                }
-                               if (env->from) {
+                               if (env->from && _php_imap_address_size(env->from) >= MAILTMPLEN) {
                                        env->from->next=NULL;
                                        address[0] = '\0';
                                        rfc822_write_address(address, env->from);
                                        add_property_string(myoverview, "from", address, 1);
                                }
-                               if (env->to) {
+                               if (env->to && _php_imap_address_size(env->from) >= MAILTMPLEN) {
                                        env->to->next = NULL;
                                        address[0] = '\0';
                                        rfc822_write_address(address, env->to);