Fixed segfault in imap_bodystruct() when called with an invalid message

number. Now it fails with a warning instead.

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 6b7de31ab314cc4cda7ca78ab80ea6f2a9fc7106..cb26d7f64407881c8855dacdd4a9ab4d86d3bcf4 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -2690,6 +2690,11 @@ PHP_FUNCTION(imap_bodystruct)
        convert_to_long_ex(msg);
        convert_to_string_ex(section);
 
+       if (!Z_LVAL_PP(msg) || Z_LVAL_PP(msg) < 1 || (unsigned) Z_LVAL_PP(msg) > imap_le_struct->imap_stream->nmsgs) {
+                php_error(E_WARNING, "Bad message number");
+                RETURN_FALSE;
+        }
+
        if (object_init(return_value) == FAILURE) {
                RETURN_FALSE;
        }