From: Ilia Alshanetsky <iliaa@php.net>
Date: Mon, 19 Mar 2007 22:56:57 +0000 (+0000)
Subject: Fixed bug #40854 (imap_mail_compose() creates an invalid terminator for
X-Git-Tag: php-5.2.2RC1~122
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=13aac95bfc915cad93916105ac2848455831000f;p=php

Fixed bug #40854 (imap_mail_compose() creates an invalid terminator for
multipart e-mails).
---

diff --git a/NEWS b/NEWS
index 766c9b44b0..ebffdb16a4 100644
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,8 @@ PHP                                                                        NEWS
 - Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)
 - Fixed a thread safety issue in gd gif read code (Nuno, Roman Nemecek)
 - Fixed CVE-2007-1001, GD wbmp used with invalid image size (Pierre)
+- Fixed bug #40854 (imap_mail_compose() creates an invalid terminator for 
+  multipart e-mails). (Ilia)
 - Fixed bug #40848 (sorting issue on 64-bit Solaris). (Wez)
 - Fixed bug #40836 (Segfault in ext/dom). (Rob)
 - Fixed bug #40833 (Crash when using unset() on an ArrayAccess object retrieved
diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index aedfe5d571..aa3c26182e 100644
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -3188,7 +3188,7 @@ PHP_FUNCTION(imap_mail_compose)
 						disp_param->next = tmp_param;
 						tmp_param = disp_param;
 					}
-				bod->parameter = disp_param;
+					bod->parameter = disp_param;
 				}
 			}
 			if (zend_hash_find(Z_ARRVAL_PP(data), "subtype", sizeof("subtype"), (void **) &pvalue)== SUCCESS) {
@@ -3337,7 +3337,7 @@ PHP_FUNCTION(imap_mail_compose)
 			} while ((part = part->next)); /* until done */
 
 			/* output trailing cookie */
-			spprintf(&tempstring, 0, "%s--%s--%s", mystring, tmp, CRLF);
+			spprintf(&tempstring, 0, "%s--%s--%s", mystring, cookie, CRLF);
 			efree(mystring);
 			mystring=tempstring;
 	} else if (bod) {
diff --git a/ext/imap/tests/bug40854.phpt b/ext/imap/tests/bug40854.phpt
new file mode 100644
index 0000000000..3df81ea29d
--- /dev/null
+++ b/ext/imap/tests/bug40854.phpt
@@ -0,0 +1,57 @@
+--TEST--                                 
+Bug #40854 (imap_mail_compose() creates an invalid terminator for multipart e-mails)
+--SKIPIF--
+<?php
+        if (!extension_loaded("imap")) { 
+                die("skip imap extension not available");  
+        }
+?>
+--FILE--
+<?php
+$envelope["from"]= "joe@example.com";
+$envelope["to"]  = "foo@example.com";
+$envelope["cc"]  = "bar@example.com";
+
+$part1["type"] = TYPEMULTIPART;
+$part1["subtype"] = "mixed";
+
+$part2["type"] = TYPEAPPLICATION;
+$part2["encoding"] = ENCBINARY;
+$part2["subtype"] = "octet-stream";
+$part2["description"] = 'a.txt';
+$part2["contents.data"] = '';
+
+$part3["type"] = TYPETEXT;
+$part3["subtype"] = "plain";
+$part3["description"] = "description3";
+$part3["contents.data"] = "contents.data3\n\n\n\t";
+
+$body[1] = $part1;
+$body[2] = $part2;
+$body[3] = $part3;
+
+echo imap_mail_compose($envelope, $body);
+?>
+--EXPECTF--
+From: joe@example.com
+To: foo@example.com
+cc: bar@example.com
+MIME-Version: 1.0
+Content-Type: MULTIPART/mixed; BOUNDARY="%s"
+
+--%s
+Content-Type: APPLICATION/octet-stream
+Content-Transfer-Encoding: BASE64
+Content-Description: a.txt
+
+
+
+--%s
+Content-Type: TEXT/plain; CHARSET=US-ASCII
+Content-Description: description3
+
+contents.data3
+
+
+	
+--%s--
\ No newline at end of file