Fixed bug #44613 (Crash inside imap_headerinfo())

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 974c23fab52ae6f611e815ade4ac8471e4710269..bd7a272c651dd94c659d6374e62e18425f714233 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -1593,8 +1593,8 @@ PHP_FUNCTION(imap_headerinfo)
        convert_to_long_ex(msgno);
        if (myargc >= 3) {
                convert_to_long_ex(fromlength);
-               if (Z_LVAL_PP(fromlength) < 0) {
-                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "From length has to be greater than or equal to 0");
+               if (Z_LVAL_PP(fromlength) < 0 || Z_LVAL_PP(fromlength) >= MAILTMPLEN) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "From length has to be between 1 and %i", MAILTMPLEN);
                        RETURN_FALSE;
                }
        } else {
@@ -1602,8 +1602,8 @@ PHP_FUNCTION(imap_headerinfo)
        }
        if (myargc >= 4) {
                convert_to_long_ex(subjectlength);
-               if (Z_LVAL_PP(subjectlength) < 0) {
-                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Subject length has to be greater than or equal to 0");
+               if (Z_LVAL_PP(subjectlength) < 0 || Z_LVAL_PP(subjectlength) >= MAILTMPLEN) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Subject length has to be between 1 and %i", MAILTMPLEN);
                        RETURN_FALSE;
                }
        } else {