Fixed bug #24150 (crash in imap_fetch_overview() &

imap_rfc822_write_address())

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index eb346554351f42b96aa59227d024c67454c6e324..26faae27c46532e669895d73ea1ef894cf79e66a 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -1997,6 +1997,10 @@ PHP_FUNCTION(imap_rfc822_write_address)
        addr->error=NIL;
        addr->adl=NIL;
 
+       if (_php_imap_address_size(addr) >= MAILTMPLEN) {
+               RETURN_FALSE;
+       }
+
        string[0]='\0';
        rfc822_write_address(string, addr);
        RETVAL_STRING(string, 1);
@@ -2745,13 +2749,13 @@ PHP_FUNCTION(imap_fetch_overview)
                                if (env->subject) {
                                        add_property_string(myoverview, "subject", env->subject, 1);
                                }
-                               if (env->from) {
+                               if (env->from && _php_imap_address_size(env->from) >= MAILTMPLEN) {
                                        env->from->next=NULL;
                                        address[0] = '\0';
                                        rfc822_write_address(address, env->from);
                                        add_property_string(myoverview, "from", address, 1);
                                }
-                               if (env->to) {
+                               if (env->to && _php_imap_address_size(env->from) >= MAILTMPLEN) {
                                        env->to->next = NULL;
                                        address[0] = '\0';
                                        rfc822_write_address(address, env->to);