From: Xinchen Hui <laruence@gmail.com>
Date: Wed, 9 Dec 2015 01:47:16 +0000 (-0800)
Subject: Fixed bug #71066 (mb_send_mail: Program terminated with signal SIGSEGV, Segmentation... 
X-Git-Tag: php-7.0.2RC1~53
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=84b997020ea47b10172207196136291c5ff09443;p=php

Fixed bug #71066 (mb_send_mail: Program terminated with signal SIGSEGV, Segmentation fault)
---

diff --git a/NEWS b/NEWS
index 299266772f..33bd38cc55 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Jan 2016 PHP 7.0.2
 
+- Mbstring:
+  . Fixed bug #71066 (mb_send_mail: Program terminated with signal SIGSEGV,
+    Segmentation fault). (Laruence)
+
 - Filter:
   . Fixed bug #71063 (filter_input(INPUT_ENV, ..) does not work). (Reeze Xia)
 
diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index c0c622a51e..09994f649b 100644
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -4109,11 +4109,12 @@ PHP_FUNCTION(mb_send_mail)
 		_php_mbstr_parse_mail_headers(&ht_headers, headers, headers_len);
 	}
 
-	if ((s = zend_hash_str_find_ptr(&ht_headers, "CONTENT-TYPE", sizeof("CONTENT-TYPE") - 1))) {
+	if ((s = zend_hash_str_find(&ht_headers, "CONTENT-TYPE", sizeof("CONTENT-TYPE") - 1))) {
 		char *tmp;
 		char *param_name;
 		char *charset = NULL;
 
+		ZEND_ASSERT(Z_TYPE_P(s) == IS_STRING);
 		p = strchr(Z_STRVAL_P(s), ';');
 
 		if (p != NULL) {