Fixed bug #35669 (imap_mail_compose() crashes with

multipart-multiboundary-email).

diff --git a/NEWS b/NEWS
index 37bb0f60fa2f0aa813fe0626dd68e229ccca7b00..5460186443157a0ad3d949b932d52349151c4375 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -22,6 +22,8 @@ PHP                                                                        NEWS
 - Fixed bug #35759 (mysqli_stmt_bind_result() makes huge allocation when
   column empty). (Andrey)
 - Fixed bug #35751 (using date with a timestamp makes httpd segfault). (Derick)
+- Fixed bug #35669 (imap_mail_compose() crashes with 
+  multipart-multiboundary-email). (Ilia)
 - Fixed bug #35517 (mysql_stmt_fetch returns NULL on data truncation). (Georg)
 - Fixed bug #35377 (PDO_SQLITE: undefined reference to "fdatasync").
   (Nuno, Jani)

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 1e17bd1055e6545f0aff7e5bc77cfbc6d9d74896..967b9be635b7507266162fffe211262c40c7ecf5 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -2837,9 +2837,10 @@ PHP_FUNCTION(imap_mail_compose)
        char *cookie = NIL;
        ENVELOPE *env;
        BODY *bod=NULL, *topbod=NULL;
-       PART *mypart=NULL, *toppart=NULL, *part;
+       PART *mypart=NULL, *part;
        PARAMETER *param, *disp_param = NULL, *custom_headers_param = NULL, *tmp_param = NULL;
        char tmp[8 * MAILTMPLEN], *mystring=NULL, *t=NULL, *tempstring=NULL;
+       int toppart = 0;
 
        if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &envelope, &body) == FAILURE) {
                ZEND_WRONG_PARAM_COUNT();
@@ -2922,7 +2923,6 @@ PHP_FUNCTION(imap_mail_compose)
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "body parameter cannot be empty");
                RETURN_FALSE;
        }
-       zend_hash_get_current_key(Z_ARRVAL_PP(body), &key, &ind, 0); /* FIXME: is this necessary?  we're not using key/ind */
 
        if (Z_TYPE_PP(data) == IS_ARRAY) {
                bod = mail_newbody();
@@ -3022,23 +3022,28 @@ PHP_FUNCTION(imap_mail_compose)
        zend_hash_move_forward(Z_ARRVAL_PP(body));
 
        while (zend_hash_get_current_data(Z_ARRVAL_PP(body), (void **) &data) == SUCCESS) {
-               zend_hash_get_current_key(Z_ARRVAL_PP(body), &key, &ind, 0);  /* FIXME: Is this necessary?  We're not using key/ind */
                if (Z_TYPE_PP(data) == IS_ARRAY) {
+                       short type = -1;
+                       if (zend_hash_find(Z_ARRVAL_PP(data), "type", sizeof("type"), (void **) &pvalue)== SUCCESS) {
+                               convert_to_long_ex(pvalue);
+                               type = (short) Z_LVAL_PP(pvalue);
+                       }
+
                        if (!toppart) {
                                bod->nested.part = mail_newbody_part();
                                mypart = bod->nested.part;
-                               toppart = mypart;
-                               bod=&mypart->body;
+                               toppart = 1;
                        } else {
-                                mypart->next = mail_newbody_part();
-                                mypart = mypart->next;
-                                bod = &mypart->body;
+                               mypart->next = mail_newbody_part();
+                               mypart = mypart->next;
                        }
 
-                       if (zend_hash_find(Z_ARRVAL_PP(data), "type", sizeof("type"), (void **) &pvalue)== SUCCESS) {
-                               convert_to_long_ex(pvalue);
-                               bod->type = (short) Z_LVAL_PP(pvalue);
-                       }
+                       bod = &mypart->body;
+
+                       if (type != TYPEMULTIPART) {
+                               bod->type = type;
+                       }                       
+
                        if (zend_hash_find(Z_ARRVAL_PP(data), "encoding", sizeof("encoding"), (void **) &pvalue)== SUCCESS) {
                                convert_to_long_ex(pvalue);
                                bod->encoding = (short) Z_LVAL_PP(pvalue);
@@ -3135,12 +3140,6 @@ PHP_FUNCTION(imap_mail_compose)
                goto done;
        }
 
-       if (bod && bod->type == TYPEMULTIPART && (!bod->nested.part || !bod->nested.part->next)) {
-               php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot generate multipart e-mail without components.");
-               RETVAL_FALSE;
-               goto done;
-       }
-
        rfc822_encode_body_7bit(env, topbod); 
        rfc822_header (tmp, env, topbod);
 

diff --git a/ext/imap/tests/bug35669.phpt b/ext/imap/tests/bug35669.phpt
new file mode 100644 (file)
index 0000000..1cc4e70
--- /dev/null
+++ b/ext/imap/tests/bug35669.phpt
@@ -0,0 +1,68 @@
+--TEST--                                 
+Bug #35669 (imap_mail_compose() crashes with multipart-multiboundary-email)
+--SKIPIF--
+<?php
+        if (!extension_loaded("imap")) { 
+                die("skip imap extension not available");  
+        }
+?>
+--FILE--
+<?php
+       $envelope["from"] = 'Santa <somewhere@northpole.gov>';
+        $envelope["to"]  = 'The bad smurf <bad@smurf.com>';
+        $envelope['date'] = 'Wed, 04 Jan 2006 19:24:43 -0500';
+                
+        $multipart["type"] = TYPEMULTIPART;
+        $multipart["subtype"] = "MIXED";
+        $body[] = $multipart; //add multipart stuff
+        
+        $textpart["type"] = TYPEMULTIPART;
+        $textpart["subtype"] = "ALTERNATIVE";
+        $body[] = $textpart; //add body part
+        
+        $plain["type"] = TYPETEXT;
+        $plain["subtype"] = "PLAIN";
+        $plain["charset"] = "iso-8859-1";
+        $plain["encoding"] = ENCQUOTEDPRINTABLE;
+        $plain["description"] = "Plaintype part of message";
+        $plain['disposition'] = "inline";
+        $plain["contents.data"] = 'See mom, it will crash';
+        
+        $body[] = $plain; //next add plain text part
+        
+        $html["type"] = TYPETEXT;
+        $html["subtype"] = "HTML";
+        $html["charset"] = "iso-8859-1";
+        $html["encoding"] = ENCQUOTEDPRINTABLE;
+        $html["description"] = "HTML part of message";
+        $html['disposition'] = "inline";
+        $html["contents.data"] = 'See mom, it will <b>crash</b>';
+        
+        $body[] = $html;
+        
+        echo imap_mail_compose($envelope, $body);
+?>
+--EXPECTF--
+Date: Wed, 04 Jan 2006 19:24:43 -0500
+From: Santa <somewhere@northpole.gov>
+To: The bad smurf <bad@smurf.com>
+MIME-Version: 1.0
+Content-Type: MULTIPART/MIXED; BOUNDARY="%s"
+
+--%s
+Content-Type: TEXT/ALTERNATIVE; CHARSET=US-ASCII
+
+
+--%s
+Content-Type: TEXT/PLAIN; CHARSET=iso-8859-1
+Content-Transfer-Encoding: QUOTED-PRINTABLE
+Content-Description: Plaintype part of message
+
+See mom, it will crash
+--%s
+Content-Type: TEXT/HTML; CHARSET=iso-8859-1
+Content-Transfer-Encoding: QUOTED-PRINTABLE
+Content-Description: HTML part of message
+
+See mom, it will <b>crash</b>
+--%s--