From: Ilia Alshanetsky <iliaa@php.net>
Date: Thu, 5 Jan 2006 00:51:34 +0000 (+0000)
Subject: MFB51: Fixed bug #35669 (imap_mail_compose() crashes with
X-Git-Tag: RELEASE_1_0_4~113
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=501c081a80855721542465396f58763b76567f0b;p=php

MFB51: Fixed bug #35669 (imap_mail_compose() crashes with
multipart-multiboundary-email).
---

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 1e17bd1055..967b9be635 100644
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -2837,9 +2837,10 @@ PHP_FUNCTION(imap_mail_compose)
 	char *cookie = NIL;
 	ENVELOPE *env;
 	BODY *bod=NULL, *topbod=NULL;
-	PART *mypart=NULL, *toppart=NULL, *part;
+	PART *mypart=NULL, *part;
 	PARAMETER *param, *disp_param = NULL, *custom_headers_param = NULL, *tmp_param = NULL;
 	char tmp[8 * MAILTMPLEN], *mystring=NULL, *t=NULL, *tempstring=NULL;
+	int toppart = 0;
 
 	if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &envelope, &body) == FAILURE) {
 		ZEND_WRONG_PARAM_COUNT();
@@ -2922,7 +2923,6 @@ PHP_FUNCTION(imap_mail_compose)
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "body parameter cannot be empty");
 		RETURN_FALSE;
 	}
-	zend_hash_get_current_key(Z_ARRVAL_PP(body), &key, &ind, 0); /* FIXME: is this necessary?  we're not using key/ind */
 
 	if (Z_TYPE_PP(data) == IS_ARRAY) {
 		bod = mail_newbody();
@@ -3022,23 +3022,28 @@ PHP_FUNCTION(imap_mail_compose)
  	zend_hash_move_forward(Z_ARRVAL_PP(body));
 
 	while (zend_hash_get_current_data(Z_ARRVAL_PP(body), (void **) &data) == SUCCESS) {
-		zend_hash_get_current_key(Z_ARRVAL_PP(body), &key, &ind, 0);  /* FIXME: Is this necessary?  We're not using key/ind */
 		if (Z_TYPE_PP(data) == IS_ARRAY) {
+			short type = -1;
+			if (zend_hash_find(Z_ARRVAL_PP(data), "type", sizeof("type"), (void **) &pvalue)== SUCCESS) {
+				convert_to_long_ex(pvalue);
+				type = (short) Z_LVAL_PP(pvalue);
+			}
+
 			if (!toppart) {
 				bod->nested.part = mail_newbody_part();
 				mypart = bod->nested.part;
-				toppart = mypart;
-				bod=&mypart->body;
+				toppart = 1;
 			} else {
-				 mypart->next = mail_newbody_part();
-				 mypart = mypart->next;
-				 bod = &mypart->body;
+				mypart->next = mail_newbody_part();
+				mypart = mypart->next;
 			}
 
-			if (zend_hash_find(Z_ARRVAL_PP(data), "type", sizeof("type"), (void **) &pvalue)== SUCCESS) {
-				convert_to_long_ex(pvalue);
-				bod->type = (short) Z_LVAL_PP(pvalue);
-			}
+			bod = &mypart->body;
+
+			if (type != TYPEMULTIPART) {
+				bod->type = type;
+			}			
+
 			if (zend_hash_find(Z_ARRVAL_PP(data), "encoding", sizeof("encoding"), (void **) &pvalue)== SUCCESS) {
 				convert_to_long_ex(pvalue);
 				bod->encoding = (short) Z_LVAL_PP(pvalue);
@@ -3135,12 +3140,6 @@ PHP_FUNCTION(imap_mail_compose)
 		goto done;
 	}
 
-	if (bod && bod->type == TYPEMULTIPART && (!bod->nested.part || !bod->nested.part->next)) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot generate multipart e-mail without components.");
-		RETVAL_FALSE;
-		goto done;
-	}
-
 	rfc822_encode_body_7bit(env, topbod); 
 	rfc822_header (tmp, env, topbod);
 
diff --git a/ext/imap/tests/bug35669.phpt b/ext/imap/tests/bug35669.phpt
new file mode 100644
index 0000000000..1cc4e702b9
--- /dev/null
+++ b/ext/imap/tests/bug35669.phpt
@@ -0,0 +1,68 @@
+--TEST--                                 
+Bug #35669 (imap_mail_compose() crashes with multipart-multiboundary-email)
+--SKIPIF--
+<?php
+        if (!extension_loaded("imap")) { 
+                die("skip imap extension not available");  
+        }
+?>
+--FILE--
+<?php
+	$envelope["from"] = 'Santa <somewhere@northpole.gov>';
+        $envelope["to"]  = 'The bad smurf <bad@smurf.com>';
+        $envelope['date'] = 'Wed, 04 Jan 2006 19:24:43 -0500';
+                
+        $multipart["type"] = TYPEMULTIPART;
+        $multipart["subtype"] = "MIXED";
+        $body[] = $multipart; //add multipart stuff
+        
+        $textpart["type"] = TYPEMULTIPART;
+        $textpart["subtype"] = "ALTERNATIVE";
+        $body[] = $textpart; //add body part
+        
+        $plain["type"] = TYPETEXT;
+        $plain["subtype"] = "PLAIN";
+        $plain["charset"] = "iso-8859-1";
+        $plain["encoding"] = ENCQUOTEDPRINTABLE;
+        $plain["description"] = "Plaintype part of message";
+        $plain['disposition'] = "inline";
+        $plain["contents.data"] = 'See mom, it will crash';
+        
+        $body[] = $plain; //next add plain text part
+        
+        $html["type"] = TYPETEXT;
+        $html["subtype"] = "HTML";
+        $html["charset"] = "iso-8859-1";
+        $html["encoding"] = ENCQUOTEDPRINTABLE;
+        $html["description"] = "HTML part of message";
+        $html['disposition'] = "inline";
+        $html["contents.data"] = 'See mom, it will <b>crash</b>';
+        
+        $body[] = $html;
+        
+        echo imap_mail_compose($envelope, $body);
+?>
+--EXPECTF--
+Date: Wed, 04 Jan 2006 19:24:43 -0500
+From: Santa <somewhere@northpole.gov>
+To: The bad smurf <bad@smurf.com>
+MIME-Version: 1.0
+Content-Type: MULTIPART/MIXED; BOUNDARY="%s"
+
+--%s
+Content-Type: TEXT/ALTERNATIVE; CHARSET=US-ASCII
+
+
+--%s
+Content-Type: TEXT/PLAIN; CHARSET=iso-8859-1
+Content-Transfer-Encoding: QUOTED-PRINTABLE
+Content-Description: Plaintype part of message
+
+See mom, it will crash
+--%s
+Content-Type: TEXT/HTML; CHARSET=iso-8859-1
+Content-Transfer-Encoding: QUOTED-PRINTABLE
+Content-Description: HTML part of message
+
+See mom, it will <b>crash</b>
+--%s--