Fixed bug #44663 (Crash in imap_mail_compose if "body" parameter invalid)

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index bd7a272c651dd94c659d6374e62e18425f714233..cab5f7e5b6b82d537292a9f55f183b6002bc51d0 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -3047,8 +3047,8 @@ PHP_FUNCTION(imap_mail_compose)
        }
 
        zend_hash_internal_pointer_reset(Z_ARRVAL_PP(body));
-       if (zend_hash_get_current_data(Z_ARRVAL_PP(body), (void **) &data) != SUCCESS) {
-               php_error_docref(NULL TSRMLS_CC, E_WARNING, "body parameter cannot be empty");
+       if (zend_hash_get_current_data(Z_ARRVAL_PP(body), (void **) &data) != SUCCESS || Z_TYPE_PP(data) != IS_ARRAY) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "body parameter must be a non-empty array");
                RETURN_FALSE;
        }