MFH: Fixed bug #32589 (Possible crash inside imap_mail_compose, with charsets).

diff --git a/NEWS b/NEWS
index 22af5bc5c6cc43460273004c2e5f0045df006f25..0b430093d99adee682ff22590aaebaf2817a02ef 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2005, PHP 5.0.5
+- Fixed bug #32589 (Possible crash inside imap_mail_compose, with charsets).
+  (Ilia)
 - Fixed bug #32560 (configure looks for incorrect db2 library). (Tony)
 - Fixed bug #32530 (chunk_split() does not append endstr if chunklen is  
   longer then the original string). (Ilia)

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index ba3db057852f3e204a266632bb620577b3da12a1..b4bf2072de66ceb318194a27ec4ecc72a85d5f97 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -3045,7 +3045,8 @@ PHP_FUNCTION(imap_mail_compose)
                        if (zend_hash_find(Z_ARRVAL_PP(data), "charset", sizeof("charset"), (void **) &pvalue)== SUCCESS) {
                                convert_to_string_ex(pvalue);
                                tmp_param = mail_newbody_parameter();
-                               tmp_param->value = cpystr(Z_STRVAL_PP(pvalue));
+                               tmp_param->value = (char *) fs_get(Z_STRLEN_PP(pvalue) + 1);
+                               memcpy(disp_param->value, Z_STRVAL_PP(pvalue), Z_STRLEN_PP(pvalue) + 1);
                                tmp_param->attribute = "CHARSET";
                                tmp_param->next = bod->parameter;
                                bod->parameter = tmp_param;