Skip to content

Commit 11c752a

Browse files
committed
Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4: Fix #80216: imap_mail_compose() does not validate types/encodings
2 parents 0443c82 + 216d6a0 commit 11c752a

File tree

3 files changed

+37
-9
lines changed

3 files changed

+37
-9
lines changed

NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ PHP NEWS
1212
. Fixed bug #80220 (imap_mail_compose() may leak memory). (cmb)
1313
. Fixed bug #80223 (imap_mail_compose() leaks envelope on malformed bodies).
1414
(cmb)
15+
. Fixed bug #80216 (imap_mail_compose() does not validate types/encodings).
16+
(cmb)
1517

1618
- Opcache:
1719
. Fixed bug #80184 (Complex expression in while / if statements resolves to

ext/imap/php_imap.c

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3181,10 +3181,16 @@ PHP_FUNCTION(imap_mail_compose)
31813181
topbod = bod;
31823182

31833183
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type", sizeof("type") - 1)) != NULL) {
3184-
bod->type = (short) zval_get_long(pvalue);
3184+
zend_long type = zval_get_long(pvalue);
3185+
if (type >= 0 && type <= TYPEMAX && body_types[type] != NULL) {
3186+
bod->type = (short) type;
3187+
}
31853188
}
31863189
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "encoding", sizeof("encoding") - 1)) != NULL) {
3187-
bod->encoding = (short) zval_get_long(pvalue);
3190+
zend_long encoding = zval_get_long(pvalue);
3191+
if (encoding >= 0 && encoding <= ENCMAX && body_encodings[encoding] != NULL) {
3192+
bod->encoding = (short) encoding;
3193+
}
31883194
}
31893195
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "charset", sizeof("charset") - 1)) != NULL) {
31903196
convert_to_string_ex(pvalue);
@@ -3266,10 +3272,13 @@ PHP_FUNCTION(imap_mail_compose)
32663272
bod->md5 = cpystr(Z_STRVAL_P(pvalue));
32673273
}
32683274
} else if (Z_TYPE_P(data) == IS_ARRAY && topbod->type == TYPEMULTIPART) {
3269-
short type = -1;
3275+
short type = 0;
32703276
SEPARATE_ARRAY(data);
32713277
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type", sizeof("type") - 1)) != NULL) {
3272-
type = (short) zval_get_long(pvalue);
3278+
zend_long tmp_type = zval_get_long(pvalue);
3279+
if (tmp_type >= 0 && tmp_type <= TYPEMAX && tmp_type != TYPEMULTIPART && body_types[tmp_type] != NULL) {
3280+
type = (short) tmp_type;
3281+
}
32733282
}
32743283

32753284
if (!toppart) {
@@ -3282,13 +3291,13 @@ PHP_FUNCTION(imap_mail_compose)
32823291
}
32833292

32843293
bod = &mypart->body;
3285-
3286-
if (type != TYPEMULTIPART) {
3287-
bod->type = type;
3288-
}
3294+
bod->type = type;
32893295

32903296
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "encoding", sizeof("encoding") - 1)) != NULL) {
3291-
bod->encoding = (short) zval_get_long(pvalue);
3297+
zend_long encoding = zval_get_long(pvalue);
3298+
if (encoding >= 0 && encoding <= ENCMAX && body_encodings[encoding] != NULL) {
3299+
bod->encoding = (short) encoding;
3300+
}
32923301
}
32933302
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "charset", sizeof("charset") - 1)) != NULL) {
32943303
convert_to_string_ex(pvalue);

ext/imap/tests/bug80216.phpt

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
Bug #80216 (imap_mail_compose() does not validate types/encodings)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('imap')) die('skip imap extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
imap_mail_compose([], [['type' => TYPEMULTIPART], []]);
10+
imap_mail_compose([], [['type' => 12]]);
11+
imap_mail_compose([], [['type' => TYPEMULTIPART], ['type' => 12]]);
12+
imap_mail_compose([], [['encoding' => 8]]);
13+
imap_mail_compose([], [['type' => TYPEMULTIPART], ['encoding' => 8]]);
14+
echo "done\n";
15+
?>
16+
--EXPECT--
17+
done

0 commit comments

Comments
 (0)