From 5fe2de0d2ab1be122e3549ae513ce3fd4c8778dd Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Wed, 2 Apr 2008 16:29:08 +0000 Subject: [PATCH] MFB: Fixed bug #44613 (Crash inside imap_headerinfo()) --- ext/imap/php_imap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c index 64b850a56f..c695735b27 100644 --- a/ext/imap/php_imap.c +++ b/ext/imap/php_imap.c @@ -1589,8 +1589,8 @@ PHP_FUNCTION(imap_headerinfo) convert_to_long_ex(msgno); if (myargc >= 3) { convert_to_long_ex(fromlength); - if (Z_LVAL_PP(fromlength) < 0) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "From length has to be greater than or equal to 0"); + if (Z_LVAL_PP(fromlength) < 0 || Z_LVAL_PP(fromlength) >= MAILTMPLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "From length has to be between 1 and %i", MAILTMPLEN); RETURN_FALSE; } } else { @@ -1598,8 +1598,8 @@ PHP_FUNCTION(imap_headerinfo) } if (myargc >= 4) { convert_to_long_ex(subjectlength); - if (Z_LVAL_PP(subjectlength) < 0) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Subject length has to be greater than or equal to 0"); + if (Z_LVAL_PP(subjectlength) < 0 || Z_LVAL_PP(subjectlength) >= MAILTMPLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Subject length has to be between 1 and %i", MAILTMPLEN); RETURN_FALSE; } } else { -- 2.40.0