Fixed bug #71066 (mb_send_mail: Program terminated with signal SIGSEGV, Segmentation...

diff --git a/NEWS b/NEWS
index 299266772f519fc7bd5fff27c8a7ea962466e91e..33bd38cc5525057525a2a9c2ecf2fd09aed205a3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Jan 2016 PHP 7.0.2
 
+- Mbstring:
+  . Fixed bug #71066 (mb_send_mail: Program terminated with signal SIGSEGV,
+    Segmentation fault). (Laruence)
+
 - Filter:
   . Fixed bug #71063 (filter_input(INPUT_ENV, ..) does not work). (Reeze Xia)
 

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index c0c622a51ed2148e9d93316b1a34045886761715..09994f649be16431c9e1efcb6da1026ae860732d 100644 (file)
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -4109,11 +4109,12 @@ PHP_FUNCTION(mb_send_mail)
                _php_mbstr_parse_mail_headers(&ht_headers, headers, headers_len);
        }
 
-       if ((s = zend_hash_str_find_ptr(&ht_headers, "CONTENT-TYPE", sizeof("CONTENT-TYPE") - 1))) {
+       if ((s = zend_hash_str_find(&ht_headers, "CONTENT-TYPE", sizeof("CONTENT-TYPE") - 1))) {
                char *tmp;
                char *param_name;
                char *charset = NULL;
 
+               ZEND_ASSERT(Z_TYPE_P(s) == IS_STRING);
                p = strchr(Z_STRVAL_P(s), ';');
 
                if (p != NULL) {