fix segfault in imap_headerinfo() when fromlength or subjectlength are less than 0

+ fix protos

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 77d83cefbad0dd649c38402fceb56a8ef740b049..b243fb37a10e185733d509049f0a99ee0fab69cb 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -1525,12 +1525,20 @@ PHP_FUNCTION(imap_headerinfo)
 
        convert_to_long_ex(msgno);
        if (myargc >= 3) {
-               convert_to_long_ex(fromlength); 
+               convert_to_long_ex(fromlength);
+               if (Z_LVAL_PP(fromlength) < 0) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "From length has to be greater than or equal to 0");
+                       RETURN_FALSE;
+               }
        } else {
                fromlength = 0x00;
        }
        if (myargc >= 4) {
                convert_to_long_ex(subjectlength);
+               if (Z_LVAL_PP(subjectlength) < 0) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Subject length has to be greater than or equal to 0");
+                       RETURN_FALSE;                   
+               }
        } else {
                subjectlength = 0x00;
        }
@@ -1798,7 +1806,7 @@ PHP_FUNCTION(imap_fetchstructure)
 }
 /* }}} */
 
-/* {{{ proto string imap_fetchbody(resource stream_id, int msg_no, int section [, int options])
+/* {{{ proto string imap_fetchbody(resource stream_id, int msg_no, string section [, int options])
    Get a specific body section */
 PHP_FUNCTION(imap_fetchbody)
 {
@@ -2612,7 +2620,7 @@ PHP_FUNCTION(imap_status)
 }
 /* }}} */
 
-/* {{{ proto object imap_bodystruct(resource stream_id, int msg_no, int section)
+/* {{{ proto object imap_bodystruct(resource stream_id, int msg_no, string section)
    Read the structure of a specified body section of a specific message */
 PHP_FUNCTION(imap_bodystruct)
 {