php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-01 21:22:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix #80220: imap_mail_compose() may leak memory

Browse Source 
Unless `topbod` is of `TYPEMULTIPART`, `mail_free_body()` does not free
the `nested.part`; while we could do this ourselves, instead we just
ignore additional bodies in this case, i.e. we don't attach them in the
first place.

Closes GH-6321.
This commit is contained in:
Christoph M. Becker
2020-10-12 10:36:18 +02:00
parent 3c4dd73c02
commit 0d022ddf03
2 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@@ -12,6 +12,7 @@ PHP NEWS
- IMAP:
. Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies). (cmb)
. Fixed bug #80215 (imap_mail_compose() may modify by-val parameters). (cmb)
. Fixed bug #80220 (imap_mail_compose() may leak memory). (cmb)
- MySQLnd:
. Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with

2
ext/imap/php_imap.c
View File

@@ -3714,7 +3714,7 @@ PHP_FUNCTION(imap_mail_compose)
convert_to_string_ex(pvalue);
bod->md5 = cpystr(Z_STRVAL_P(pvalue));
}
} else if (Z_TYPE_P(data) == IS_ARRAY) {
} else if (Z_TYPE_P(data) == IS_ARRAY && topbod->type == TYPEMULTIPART) {
short type = -1;
SEPARATE_ARRAY(data);
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type", sizeof("type") - 1)) != NULL) {