MFH: Fixed bug #26909 (crash in imap_mime_header_decode() when no encoding is

used).

diff --git a/NEWS b/NEWS
index dc2b86db4c3378972411bf7246142d92abe51316..d3abf874cba9ac5962bfc11394bebd8a6de14802 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Jan 2004, Version 4.3.5
+- Fixed bug #26909 (crash in imap_mime_header_decode() when no encoding is 
+  used). (Ilia)
 - Fixed bug #26878 (problem with multiple references to the same variable 
   with different types). (Ilia)
 - Fixed bug #26896 (ext/ftp does not work as shared extension). (Jani)

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 85191083fba94b50d524036ec351b5e73fdc834a..4bd38121040d6cda98bd217830844b99d6f61fc9 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -3577,8 +3577,12 @@ PHP_FUNCTION(imap_mime_header_decode)
                                                add_property_string(myobject, "charset", charset, 1);
                                                add_property_string(myobject, "text", decode, 1);
                                                zend_hash_next_index_insert(Z_ARRVAL_P(return_value), (void *)&myobject, sizeof(zval *), NULL);
-                                               fs_give((void**)&decode);
                                                
+                                               /* only free decode if it was allocated by rfc822_qprint or rfc822_base64 */
+                                               if (decode != text) {
+                                                       fs_give((void**)&decode);
+                                               }
+
                                                offset = end_token+2;
                                                for (i = 0; (string[offset + i] == ' ') || (string[offset + i] == 0x0a) || (string[offset + i] == 0x0d); i++);
                                                if ((string[offset + i] == '=') && (string[offset + i + 1] == '?') && (offset + i < end)) {