MFB: Fixed bug #44613 (Crash inside imap_headerinfo())

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 64b850a56f696138efb46682442f76806f90e44d..c695735b27e63027f27c33aeb9e71f6f404b58ca 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -1589,8 +1589,8 @@ PHP_FUNCTION(imap_headerinfo)
        convert_to_long_ex(msgno);
        if (myargc >= 3) {
                convert_to_long_ex(fromlength);
-               if (Z_LVAL_PP(fromlength) < 0) {
-                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "From length has to be greater than or equal to 0");
+               if (Z_LVAL_PP(fromlength) < 0 || Z_LVAL_PP(fromlength) >= MAILTMPLEN) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "From length has to be between 1 and %i", MAILTMPLEN);
                        RETURN_FALSE;
                }
        } else {
@@ -1598,8 +1598,8 @@ PHP_FUNCTION(imap_headerinfo)
        }
        if (myargc >= 4) {
                convert_to_long_ex(subjectlength);
-               if (Z_LVAL_PP(subjectlength) < 0) {
-                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Subject length has to be greater than or equal to 0");
+               if (Z_LVAL_PP(subjectlength) < 0 || Z_LVAL_PP(subjectlength) >= MAILTMPLEN) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Subject length has to be between 1 and %i", MAILTMPLEN);
                        RETURN_FALSE;
                }
        } else {