php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-02 05:32:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.3' into PHP-7.4

Browse Source 
* PHP-7.3:
  Fix #80216: imap_mail_compose() does not validate types/encodings
This commit is contained in:
Christoph M. Becker
2020-10-12 16:28:36 +02:00
parent 4a469c7e98 73e43b6e19
commit 216d6a024a
3 changed files with 37 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -19,6 +19,8 @@ PHP NEWS
. Fixed bug #80220 (imap_mail_compose() may leak memory). (cmb)
. Fixed bug #80223 (imap_mail_compose() leaks envelope on malformed bodies).
(cmb)
. Fixed bug #80216 (imap_mail_compose() does not validate types/encodings).
(cmb)
- MySQLnd:
. Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with

27
ext/imap/php_imap.c
View File

@@ -3643,10 +3643,16 @@ PHP_FUNCTION(imap_mail_compose)
topbod = bod;
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type", sizeof("type") - 1)) != NULL) {
bod->type = (short) zval_get_long(pvalue);
zend_long type = zval_get_long(pvalue);
if (type >= 0 && type <= TYPEMAX && body_types[type] != NULL) {
bod->type = (short) type;
}
}
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "encoding", sizeof("encoding") - 1)) != NULL) {
bod->encoding = (short) zval_get_long(pvalue);
zend_long encoding = zval_get_long(pvalue);
if (encoding >= 0 && encoding <= ENCMAX && body_encodings[encoding] != NULL) {
bod->encoding = (short) encoding;
}
}
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "charset", sizeof("charset") - 1)) != NULL) {
convert_to_string_ex(pvalue);
@@ -3728,10 +3734,13 @@ PHP_FUNCTION(imap_mail_compose)
bod->md5 = cpystr(Z_STRVAL_P(pvalue));
}
} else if (Z_TYPE_P(data) == IS_ARRAY && topbod->type == TYPEMULTIPART) {
short type = -1;
short type = 0;
SEPARATE_ARRAY(data);
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type", sizeof("type") - 1)) != NULL) {
type = (short) zval_get_long(pvalue);
zend_long tmp_type = zval_get_long(pvalue);
if (tmp_type >= 0 && tmp_type <= TYPEMAX && tmp_type != TYPEMULTIPART && body_types[tmp_type] != NULL) {
type = (short) tmp_type;
}
}
if (!toppart) {
@@ -3744,13 +3753,13 @@ PHP_FUNCTION(imap_mail_compose)
}
bod = &mypart->body;
if (type != TYPEMULTIPART) {
bod->type = type;
}
bod->type = type;
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "encoding", sizeof("encoding") - 1)) != NULL) {
bod->encoding = (short) zval_get_long(pvalue);
zend_long encoding = zval_get_long(pvalue);
if (encoding >= 0 && encoding <= ENCMAX && body_encodings[encoding] != NULL) {
bod->encoding = (short) encoding;
}
}
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "charset", sizeof("charset") - 1)) != NULL) {
convert_to_string_ex(pvalue);

17
ext/imap/tests/bug80216.phpt Normal file
View File

@@ -0,0 +1,17 @@
--TEST--
Bug #80216 (imap_mail_compose() does not validate types/encodings)
--SKIPIF--
<?php
if (!extension_loaded('imap')) die('skip imap extension not available');
?>
--FILE--
<?php
imap_mail_compose([], [['type' => TYPEMULTIPART], []]);
imap_mail_compose([], [['type' => 12]]);
imap_mail_compose([], [['type' => TYPEMULTIPART], ['type' => 12]]);
imap_mail_compose([], [['encoding' => 8]]);
imap_mail_compose([], [['type' => TYPEMULTIPART], ['encoding' => 8]]);
echo "done\n";
?>
--EXPECT--
done