From: Ilia Alshanetsky <iliaa@php.net>
Date: Tue, 5 Apr 2005 14:47:47 +0000 (+0000)
Subject: Fixed bug #32589 (Possible crash inside imap_mail_compose, with charsets).
X-Git-Tag: php-5.0.1b1~605
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=cb8d20760c1854211d485d8a38d82bbef8ca0eb8;p=php

Fixed bug #32589 (Possible crash inside imap_mail_compose, with charsets).
---

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 1257731b24..7e6fa12b5e 100644
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -3045,7 +3045,8 @@ PHP_FUNCTION(imap_mail_compose)
 			if (zend_hash_find(Z_ARRVAL_PP(data), "charset", sizeof("charset"), (void **) &pvalue)== SUCCESS) {
 				convert_to_string_ex(pvalue);
 				tmp_param = mail_newbody_parameter();
-				tmp_param->value = cpystr(Z_STRVAL_PP(pvalue));
+				tmp_param->value = (char *) fs_get(Z_STRLEN_PP(pvalue) + 1);
+				memcpy(disp_param->value, Z_STRVAL_PP(pvalue), Z_STRLEN_PP(pvalue) + 1);
 				tmp_param->attribute = "CHARSET";
 				tmp_param->next = bod->parameter;
 				bod->parameter = tmp_param;