@@ -3181,10 +3181,16 @@ PHP_FUNCTION(imap_mail_compose)
3181
3181
topbod = bod ;
3182
3182
3183
3183
if ((pvalue = zend_hash_str_find (Z_ARRVAL_P (data ), "type" , sizeof ("type" ) - 1 )) != NULL ) {
3184
- bod -> type = (short ) zval_get_long (pvalue );
3184
+ zend_long type = zval_get_long (pvalue );
3185
+ if (type >= 0 && type <= TYPEMAX && body_types [type ] != NULL ) {
3186
+ bod -> type = (short ) type ;
3187
+ }
3185
3188
}
3186
3189
if ((pvalue = zend_hash_str_find (Z_ARRVAL_P (data ), "encoding" , sizeof ("encoding" ) - 1 )) != NULL ) {
3187
- bod -> encoding = (short ) zval_get_long (pvalue );
3190
+ zend_long encoding = zval_get_long (pvalue );
3191
+ if (encoding >= 0 && encoding <= ENCMAX && body_encodings [encoding ] != NULL ) {
3192
+ bod -> encoding = (short ) encoding ;
3193
+ }
3188
3194
}
3189
3195
if ((pvalue = zend_hash_str_find (Z_ARRVAL_P (data ), "charset" , sizeof ("charset" ) - 1 )) != NULL ) {
3190
3196
convert_to_string_ex (pvalue );
@@ -3266,10 +3272,13 @@ PHP_FUNCTION(imap_mail_compose)
3266
3272
bod -> md5 = cpystr (Z_STRVAL_P (pvalue ));
3267
3273
}
3268
3274
} else if (Z_TYPE_P (data ) == IS_ARRAY && topbod -> type == TYPEMULTIPART ) {
3269
- short type = -1 ;
3275
+ short type = 0 ;
3270
3276
SEPARATE_ARRAY (data );
3271
3277
if ((pvalue = zend_hash_str_find (Z_ARRVAL_P (data ), "type" , sizeof ("type" ) - 1 )) != NULL ) {
3272
- type = (short ) zval_get_long (pvalue );
3278
+ zend_long tmp_type = zval_get_long (pvalue );
3279
+ if (tmp_type >= 0 && tmp_type <= TYPEMAX && tmp_type != TYPEMULTIPART && body_types [tmp_type ] != NULL ) {
3280
+ type = (short ) tmp_type ;
3281
+ }
3273
3282
}
3274
3283
3275
3284
if (!toppart ) {
@@ -3282,13 +3291,13 @@ PHP_FUNCTION(imap_mail_compose)
3282
3291
}
3283
3292
3284
3293
bod = & mypart -> body ;
3285
-
3286
- if (type != TYPEMULTIPART ) {
3287
- bod -> type = type ;
3288
- }
3294
+ bod -> type = type ;
3289
3295
3290
3296
if ((pvalue = zend_hash_str_find (Z_ARRVAL_P (data ), "encoding" , sizeof ("encoding" ) - 1 )) != NULL ) {
3291
- bod -> encoding = (short ) zval_get_long (pvalue );
3297
+ zend_long encoding = zval_get_long (pvalue );
3298
+ if (encoding >= 0 && encoding <= ENCMAX && body_encodings [encoding ] != NULL ) {
3299
+ bod -> encoding = (short ) encoding ;
3300
+ }
3292
3301
}
3293
3302
if ((pvalue = zend_hash_str_find (Z_ARRVAL_P (data ), "charset" , sizeof ("charset" ) - 1 )) != NULL ) {
3294
3303
convert_to_string_ex (pvalue );
0 commit comments