MFH: Fixed bug #31142 (imap_mail_compose() fails to generate correct output).

diff --git a/NEWS b/NEWS
index 8d955bc1af3b7e120cbf0951de9e2b292c97eae2..c804ac8c4115add1cd22bc7b56b0962eddbcf9f7 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,7 @@ PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, Version 4.3.11
 - Fixed bug #31174 (compile warning in url.c). (Ilia, lukem at NetBSD dot org)
+- Fixed bug #31142 (imap_mail_compose() fails to generate correct output). (Ilia)
 - Fixed bug #31120 (mssql_query returns false on successfull inserts and 
   stored procedures). (Frank)
 - Fixed bug #31111 (Linux/Sparc: Compile failure of zend_strtod.c). (Derick)

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index aa4c9ba5d64547d29e910b9a5959d91b6dd29232..d34a3acc3535379a729170f7551057e95c4d4416 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -3140,29 +3140,22 @@ PHP_FUNCTION(imap_mail_compose)
                                bod=&part->body;
 
                                tempstring=emalloc(strlen(bod->contents.text.data)+strlen(CRLF)+strlen(mystring)+1);
-                               strcpy(tempstring, mystring);
+                               sprintf(tempstring, "%s%s%s", mystring, bod->contents.text.data, CRLF);
                                efree(mystring);
                                mystring=tempstring;
-                               sprintf(mystring, "%s%s%s", mystring, bod->contents.text.data, CRLF);
-
                        } while ((part = part->next)); /* until done */
 
                        /* output trailing cookie */
                        sprintf(tmp, "--%s--", cookie);
                        tempstring=emalloc(strlen(tmp)+strlen(CRLF)+strlen(mystring)+1);
-                       strcpy(tempstring, mystring);
+                       sprintf(tempstring, "%s%s%s", mystring, tmp, CRLF);
                        efree(mystring);
                        mystring=tempstring;
-                       sprintf(mystring, "%s%s%s", mystring, tmp, CRLF);
-
        } else if (bod) {
-
-                       tempstring=emalloc(strlen(bod->contents.text.data)+strlen(CRLF)+strlen(mystring)+1);
-                       strcpy(tempstring, mystring);
+                       tempstring = emalloc(strlen(bod->contents.text.data)+strlen(CRLF)+strlen(mystring)+1);
+                       sprintf(tempstring, "%s%s%s", mystring, bod->contents.text.data, CRLF);
                        efree(mystring);
                        mystring=tempstring;
-                       sprintf(mystring, "%s%s%s", mystring, bod->contents.text.data, CRLF);
-
        } else {
                efree(mystring);
                RETURN_FALSE;