From: Ilia Alshanetsky <iliaa@php.net>
Date: Tue, 18 Jan 2005 16:34:04 +0000 (+0000)
Subject: MFH: Fixed bug #31480 (Possible infinite loop in imap_mail_compose()).
X-Git-Tag: php-4.3.11RC1~140
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9ccca60a1f4cb583f4b43d720de0dff84828e21b;p=php

MFH: Fixed bug #31480 (Possible infinite loop in imap_mail_compose()).
---

diff --git a/NEWS b/NEWS
index 6d6a1be0a4..2fc6aa8388 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,7 @@ PHP 4                                                                      NEWS
 - Fixed MacOSX shared extensions crashing on Apache startup. (Rasmus)
 - Added Oracle Instant Client support. (cjbj at hotmail dot com, Tony)
 - Fixed bug #31580 (fgetcsv() problematic with "" escape sequences). (Ilia)
+- Fixed bug #31480 (Possible infinite loop in imap_mail_compose()). (Ilia)
 - Fixed bug #31479 (Fixed crash in chunk_split(), when chunklen > strlen). (Ilia)
 - Fixed bug #31454 (session_set_save_handler crashes PHP when supplied
   non-existent object ref). (Tony)
diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 19bbf33c2b..e7a3381b3c 100644
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -3060,7 +3060,7 @@ PHP_FUNCTION(imap_mail_compose)
 				bod->contents.text.size = Z_STRLEN_PP(pvalue);
 			} else {
 				bod->contents.text.data = (char *) fs_get(1);
-				bod->contents.text.data = "";
+				memcpy(bod->contents.text.data, "", 1);
 				bod->contents.text.size = 0;
 			}
 			if (zend_hash_find(Z_ARRVAL_PP(data), "lines", sizeof("lines"), (void **) &pvalue)== SUCCESS) {
@@ -3075,9 +3075,8 @@ PHP_FUNCTION(imap_mail_compose)
 				convert_to_string_ex(pvalue);
 				bod->md5 = cpystr(Z_STRVAL_PP(pvalue));
 			}
-
-			zend_hash_move_forward(Z_ARRVAL_PP(body));
 		}
+		zend_hash_move_forward(Z_ARRVAL_PP(body));
 	}
 
 	rfc822_encode_body_7bit(env, topbod);