MFH: Fixed bug #31480 (Possible infinite loop in imap_mail_compose()).

diff --git a/NEWS b/NEWS
index ef01e59bf93ef7e09c0f00531ff36783f6add6f4..4d3a476599b262b0fe7359a5eb02cd5ec5f103b4 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,7 @@ PHP                                                                        NEWS
 - Added Oracle Instant Client support. (cjbj at hotmail dot com, Tony)
 - Added length and charsetnr for field array and object in mysqli. (Georg)
 - Fixed a bug in mysqli_stmt_execute() (type conversion with NULL values). (Georg)
+- Fixed bug #31480 (Possible infinite loop in imap_mail_compose()). (Ilia)
 - Fixed bug #31479 (Fixed crash in chunk_split(), when chunklen > strlen). (Ilia)
 - Fixed bug #31454 (session_set_save_handler crashes PHP when supplied 
   non-existent object ref). (Tony)

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 05447abc81c714a8e1032818ff7b2564348a6a11..aa66dea7bdb686ac680639d0683cbbb730816694 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -3089,7 +3089,7 @@ PHP_FUNCTION(imap_mail_compose)
                                bod->contents.text.size = Z_STRLEN_PP(pvalue);
                        } else {
                                bod->contents.text.data = (char *) fs_get(1);
-                               bod->contents.text.data = "";
+                               memcpy(bod->contents.text.data, "", 1);
                                bod->contents.text.size = 0;
                        }
                        if (zend_hash_find(Z_ARRVAL_PP(data), "lines", sizeof("lines"), (void **) &pvalue)== SUCCESS) {
@@ -3104,9 +3104,8 @@ PHP_FUNCTION(imap_mail_compose)
                                convert_to_string_ex(pvalue);
                                bod->md5 = cpystr(Z_STRVAL_PP(pvalue));
                        }
-
-                       zend_hash_move_forward(Z_ARRVAL_PP(body));
                }
+               zend_hash_move_forward(Z_ARRVAL_PP(body));
        }
 
        rfc822_encode_body_7bit(env, topbod);