Fixed bug #40854 (imap_mail_compose() creates an invalid terminator for

multipart e-mails).

diff --git a/NEWS b/NEWS
index 766c9b44b0b068f05766c4d7de65fa46783d50ab..ebffdb16a47a3b7171eea6ffd7be8576c88d3b57 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,8 @@ PHP                                                                        NEWS
 - Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)
 - Fixed a thread safety issue in gd gif read code (Nuno, Roman Nemecek)
 - Fixed CVE-2007-1001, GD wbmp used with invalid image size (Pierre)
+- Fixed bug #40854 (imap_mail_compose() creates an invalid terminator for 
+  multipart e-mails). (Ilia)
 - Fixed bug #40848 (sorting issue on 64-bit Solaris). (Wez)
 - Fixed bug #40836 (Segfault in ext/dom). (Rob)
 - Fixed bug #40833 (Crash when using unset() on an ArrayAccess object retrieved

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index aedfe5d57132a38c300325f3e61042de7dac8846..aa3c26182e4c5f0c76a87bba45decf56ab22f040 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -3188,7 +3188,7 @@ PHP_FUNCTION(imap_mail_compose)
                                                disp_param->next = tmp_param;
                                                tmp_param = disp_param;
                                        }
-                               bod->parameter = disp_param;
+                                       bod->parameter = disp_param;
                                }
                        }
                        if (zend_hash_find(Z_ARRVAL_PP(data), "subtype", sizeof("subtype"), (void **) &pvalue)== SUCCESS) {
@@ -3337,7 +3337,7 @@ PHP_FUNCTION(imap_mail_compose)
                        } while ((part = part->next)); /* until done */
 
                        /* output trailing cookie */
-                       spprintf(&tempstring, 0, "%s--%s--%s", mystring, tmp, CRLF);
+                       spprintf(&tempstring, 0, "%s--%s--%s", mystring, cookie, CRLF);
                        efree(mystring);
                        mystring=tempstring;
        } else if (bod) {

diff --git a/ext/imap/tests/bug40854.phpt b/ext/imap/tests/bug40854.phpt
new file mode 100644 (file)
index 0000000..3df81ea
--- /dev/null
+++ b/ext/imap/tests/bug40854.phpt
@@ -0,0 +1,57 @@
+--TEST--                                 
+Bug #40854 (imap_mail_compose() creates an invalid terminator for multipart e-mails)
+--SKIPIF--
+<?php
+        if (!extension_loaded("imap")) { 
+                die("skip imap extension not available");  
+        }
+?>
+--FILE--
+<?php
+$envelope["from"]= "joe@example.com";
+$envelope["to"]  = "foo@example.com";
+$envelope["cc"]  = "bar@example.com";
+
+$part1["type"] = TYPEMULTIPART;
+$part1["subtype"] = "mixed";
+
+$part2["type"] = TYPEAPPLICATION;
+$part2["encoding"] = ENCBINARY;
+$part2["subtype"] = "octet-stream";
+$part2["description"] = 'a.txt';
+$part2["contents.data"] = '';
+
+$part3["type"] = TYPETEXT;
+$part3["subtype"] = "plain";
+$part3["description"] = "description3";
+$part3["contents.data"] = "contents.data3\n\n\n\t";
+
+$body[1] = $part1;
+$body[2] = $part2;
+$body[3] = $part3;
+
+echo imap_mail_compose($envelope, $body);
+?>
+--EXPECTF--
+From: joe@example.com
+To: foo@example.com
+cc: bar@example.com
+MIME-Version: 1.0
+Content-Type: MULTIPART/mixed; BOUNDARY="%s"
+
+--%s
+Content-Type: APPLICATION/octet-stream
+Content-Transfer-Encoding: BASE64
+Content-Description: a.txt
+
+
+
+--%s
+Content-Type: TEXT/plain; CHARSET=US-ASCII
+Content-Description: description3
+
+contents.data3
+
+
+       
+--%s--
\ No newline at end of file