MFH: fix #35692(iconv_mime_decode() segfault, with libiconv only)

diff --git a/NEWS b/NEWS
index 0991fdfe16aafbc6ccdd9f78dce38d1c583c4f03..1d179f8e1b037e94b194d220bab37c7b999d244a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -27,6 +27,8 @@ PHP                                                                        NEWS
 - Fixed crash and leak in mysqli when using 4.1.x client libraries and
   connecting to 5.x server. (Andrey)
 - Fixed bug #35694 (Improved error message for invalid fetch mode). (Ilia)
+- Fixed bug #35692 (iconv_mime_decode() segmentation fault; with libiconv 
+  only). (Tony)
 - Fixed bug #35690 (pack() tries to allocate huge memory block when packing 
   float values to strings). (Tony)
 - Fixed bug #35655 (whitespace following end of heredoc is lost). (Ilia)

diff --git a/ext/iconv/iconv.c b/ext/iconv/iconv.c
index ef88c5f258bc5a55f5a11fca436d0cc28fff8ac3..3ad87b4d78c82fae3c5ffc1a6586a714be996736 100644 (file)
--- a/ext/iconv/iconv.c
+++ b/ext/iconv/iconv.c
@@ -1366,7 +1366,7 @@ static php_iconv_err_t _php_iconv_mime_decode(smart_str *pretval, const char *st
 
                                        if (cd == (iconv_t)(-1)) {
                                                if ((mode & PHP_ICONV_MIME_DECODE_CONTINUE_ON_ERROR)) {
-                                                       err = _php_iconv_appendl(pretval, encoded_word, (size_t)((p1 + 1) - encoded_word), cd); 
+                                                       err = _php_iconv_appendl(pretval, encoded_word, (size_t)((p1 + 1) - encoded_word), cd_pl); 
                                                        if (err != PHP_ICONV_ERR_SUCCESS) {
                                                                goto out;
                                                        }