From: Vlad Krupin <vlad@php.net>
Date: Sat, 12 Jan 2002 05:39:07 +0000 (+0000)
Subject: Fixed segfault in imap_bodystruct() when called with an invalid message
X-Git-Tag: PRE_ISSET_PATCH~213
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8df03e2814aed732c0fbe3d45143433495533608;p=php

Fixed segfault in imap_bodystruct() when called with an invalid message
number. Now it fails with a warning instead.
---

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 6b7de31ab3..cb26d7f644 100644
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -2690,6 +2690,11 @@ PHP_FUNCTION(imap_bodystruct)
  	convert_to_long_ex(msg);
 	convert_to_string_ex(section);
 
+	if (!Z_LVAL_PP(msg) || Z_LVAL_PP(msg) < 1 || (unsigned) Z_LVAL_PP(msg) > imap_le_struct->imap_stream->nmsgs) {
+                php_error(E_WARNING, "Bad message number");
+                RETURN_FALSE;
+        }
+
 	if (object_init(return_value) == FAILURE) {
 		RETURN_FALSE;
 	}