Fix #80220: imap_mail_compose() may leak memory

Unless `topbod` is of `TYPEMULTIPART`, `mail_free_body()` does not free
the `nested.part`; while we could do this ourselves, instead we just
ignore additional bodies in this case, i.e. we don't attach them in the
first place.

Closes GH-6321.

diff --git a/NEWS b/NEWS
index d2b3c01a93dcafd850424137c064ce09583e2bd7..72f731aef19528961f36b9961a17872f6cbe0665 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,7 @@ PHP                                                                        NEWS
 - IMAP:
   . Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies). (cmb)
   . Fixed bug #80215 (imap_mail_compose() may modify by-val parameters). (cmb)
+  . Fixed bug #80220 (imap_mail_compose() may leak memory). (cmb)
 
 - MySQLnd:
   . Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 7901777f818bf3d1784eeafd773268ac73c3bf95..0cf350e907b49f84ebae57323b0d1f588a28eb1c 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -3714,7 +3714,7 @@ PHP_FUNCTION(imap_mail_compose)
                                convert_to_string_ex(pvalue);
                                bod->md5 = cpystr(Z_STRVAL_P(pvalue));
                        }
-               } else if (Z_TYPE_P(data) == IS_ARRAY) {
+               } else if (Z_TYPE_P(data) == IS_ARRAY && topbod->type == TYPEMULTIPART) {
                        short type = -1;
                        SEPARATE_ARRAY(data);
                        if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type", sizeof("type") - 1)) != NULL) {