Skip to content

Commit 2b5cd5b

Browse files
author
Zoe Slattery
committed
bug #46884 fix
1 parent 071a3c3 commit 2b5cd5b

File tree

1 file changed

+52
-22
lines changed

1 file changed

+52
-22
lines changed

‎ext/imap/php_imap.c

Lines changed: 52 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1208,22 +1208,29 @@ PHP_FUNCTION(imap_headers)
12081208
Read the message body */
12091209
PHP_FUNCTION(imap_body)
12101210
{
1211-
zval **streamind, **msgno, **flags;
1211+
zval **streamind, **msgno, **pflags;
12121212
pils *imap_le_struct;
12131213
int msgindex, myargc=ZEND_NUM_ARGS();
1214+
long flags=0L;
12141215

1215-
if (myargc < 2 || myargc > 3 || zend_get_parameters_ex(myargc, &streamind, &msgno, &flags) == FAILURE) {
1216+
if (myargc < 2 || myargc > 3 || zend_get_parameters_ex(myargc, &streamind, &msgno, &pflags) == FAILURE) {
12161217
ZEND_WRONG_PARAM_COUNT();
12171218
}
12181219

1220+
12191221
ZEND_FETCH_RESOURCE(imap_le_struct, pils *, streamind, -1, "imap", le_imap);
12201222

12211223
convert_to_long_ex(msgno);
12221224
if (myargc == 3) {
1223-
convert_to_long_ex(flags);
1225+
convert_to_long_ex(pflags);
1226+
flags = Z_LVAL_PP(pflags);
1227+
if (flags && ((flags & ~(FT_UID|FT_PEEK|FT_INTERNAL)) != 0)) {
1228+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "invalid value for the options parameter");
1229+
RETURN_FALSE;
1230+
}
12241231
}
12251232

1226-
if ((myargc == 3) && (Z_LVAL_PP(flags) & FT_UID)) {
1233+
if ((myargc == 3) && (flags & FT_UID)) {
12271234
/* This should be cached; if it causes an extra RTT to the
12281235
IMAP server, then that's the price we pay for making
12291236
sure we don't crash. */
@@ -1236,7 +1243,7 @@ PHP_FUNCTION(imap_body)
12361243
RETURN_FALSE;
12371244
}
12381245

1239-
RETVAL_STRING(mail_fetchtext_full (imap_le_struct->imap_stream, Z_LVAL_PP(msgno), NIL, myargc==3 ? Z_LVAL_PP(flags) : NIL), 1);
1246+
RETVAL_STRING(mail_fetchtext_full (imap_le_struct->imap_stream, Z_LVAL_PP(msgno), NIL, myargc==3 ? Z_LVAL_PP(pflags) : NIL), 1);
12401247
}
12411248
/* }}} */
12421249

@@ -1830,14 +1837,16 @@ PHP_FUNCTION(imap_unsubscribe)
18301837
Read the full structure of a message */
18311838
PHP_FUNCTION(imap_fetchstructure)
18321839
{
1833-
zval **streamind, **msgno, **flags;
1840+
zval **streamind, **msgno, **pflags;
18341841
pils *imap_le_struct;
18351842
BODY *body;
18361843
int msgindex, myargc=ZEND_NUM_ARGS();
1844+
long flags=0L;
18371845

1838-
if (myargc < 2 || myargc > 3 || zend_get_parameters_ex(myargc, &streamind, &msgno, &flags) == FAILURE) {
1846+
if (myargc < 2 || myargc > 3 || zend_get_parameters_ex(myargc, &streamind, &msgno, &pflags) == FAILURE) {
18391847
ZEND_WRONG_PARAM_COUNT();
18401848
}
1849+
18411850

18421851
ZEND_FETCH_RESOURCE(imap_le_struct, pils *, streamind, -1, "imap", le_imap);
18431852

@@ -1846,12 +1855,18 @@ PHP_FUNCTION(imap_fetchstructure)
18461855
RETURN_FALSE;
18471856
}
18481857
if (myargc == 3) {
1849-
convert_to_long_ex(flags);
1858+
convert_to_long_ex(pflags);
1859+
flags = Z_LVAL_PP(pflags);
1860+
1861+
if (flags && ((flags & ~FT_UID) != 0)) {
1862+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "invalid value for the options parameter");
1863+
RETURN_FALSE;
1864+
}
18501865
}
18511866

18521867
object_init(return_value);
18531868

1854-
if ((myargc == 3) && (Z_LVAL_PP(flags) & FT_UID)) {
1869+
if ((myargc == 3) && (flags & FT_UID)) {
18551870
/* This should be cached; if it causes an extra RTT to the
18561871
IMAP server, then that's the price we pay for making
18571872
sure we don't crash. */
@@ -1861,7 +1876,7 @@ PHP_FUNCTION(imap_fetchstructure)
18611876
}
18621877
PHP_IMAP_CHECK_MSGNO(msgindex);
18631878

1864-
mail_fetchstructure_full(imap_le_struct->imap_stream, Z_LVAL_PP(msgno), &body , myargc == 3 ? Z_LVAL_PP(flags) : NIL);
1879+
mail_fetchstructure_full(imap_le_struct->imap_stream, Z_LVAL_PP(msgno), &body , myargc == 3 ? Z_LVAL_PP(pflags) : NIL);
18651880

18661881
if (!body) {
18671882
php_error_docref(NULL TSRMLS_CC, E_WARNING, "No body information available");
@@ -1876,30 +1891,37 @@ PHP_FUNCTION(imap_fetchstructure)
18761891
Get a specific body section */
18771892
PHP_FUNCTION(imap_fetchbody)
18781893
{
1879-
zval **streamind, **msgno, **sec, **flags;
1894+
zval **streamind, **msgno, **sec, **pflags;
18801895
pils *imap_le_struct;
18811896
char *body;
1897+
long flags=0L;
18821898
unsigned long len;
18831899
int myargc=ZEND_NUM_ARGS();
18841900

1885-
if (myargc < 3 || myargc > 4 || zend_get_parameters_ex(myargc, &streamind, &msgno, &sec, &flags) == FAILURE) {
1901+
if (myargc < 3 || myargc > 4 || zend_get_parameters_ex(myargc, &streamind, &msgno, &sec, &pflags) == FAILURE) {
18861902
ZEND_WRONG_PARAM_COUNT();
18871903
}
18881904

1905+
18891906
ZEND_FETCH_RESOURCE(imap_le_struct, pils *, streamind, -1, "imap", le_imap);
18901907

18911908
convert_to_long_ex(msgno);
18921909
convert_to_string_ex(sec);
18931910
if (myargc == 4) {
1894-
convert_to_long_ex(flags);
1911+
convert_to_long_ex(pflags);
1912+
flags = Z_LVAL_PP(pflags);
1913+
if (flags && ((flags & ~(FT_UID|FT_PEEK|FT_INTERNAL)) != 0)) {
1914+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "invalid value for the options parameter");
1915+
RETURN_FALSE;
1916+
}
18951917
}
18961918

1897-
if (myargc < 4 || !(Z_LVAL_PP(flags) & FT_UID)) {
1919+
if (myargc < 4 || !(flags & FT_UID)) {
18981920
/* only perform the check if the msgno is a message number and not a UID */
18991921
PHP_IMAP_CHECK_MSGNO(Z_LVAL_PP(msgno));
19001922
}
19011923

1902-
body = mail_fetchbody_full(imap_le_struct->imap_stream, Z_LVAL_PP(msgno), Z_STRVAL_PP(sec), &len, myargc==4 ? Z_LVAL_PP(flags) : NIL);
1924+
body = mail_fetchbody_full(imap_le_struct->imap_stream, Z_LVAL_PP(msgno), Z_STRVAL_PP(sec), &len, myargc==4 ? Z_LVAL_PP(pflags) : NIL);
19031925

19041926
if (!body) {
19051927
php_error_docref(NULL TSRMLS_CC, E_WARNING, "No body information available");
@@ -2640,22 +2662,29 @@ PHP_FUNCTION(imap_sort)
26402662
Get the full unfiltered header for a message */
26412663
PHP_FUNCTION(imap_fetchheader)
26422664
{
2643-
zval **streamind, **msgno, **flags;
2665+
zval **streamind, **msgno, **pflags;
26442666
pils *imap_le_struct;
26452667
int msgindex, myargc = ZEND_NUM_ARGS();
2668+
long flags=0L;
26462669

2647-
if (myargc < 2 || myargc > 3 || zend_get_parameters_ex(myargc, &streamind, &msgno, &flags) == FAILURE) {
2670+
if (myargc < 2 || myargc > 3 || zend_get_parameters_ex(myargc, &streamind, &msgno, &pflags) == FAILURE) {
26482671
ZEND_WRONG_PARAM_COUNT();
26492672
}
2650-
2673+
26512674
ZEND_FETCH_RESOURCE(imap_le_struct, pils *, streamind, -1, "imap", le_imap);
26522675

26532676
convert_to_long_ex(msgno);
26542677
if (myargc == 3) {
2655-
convert_to_long_ex(flags);
2656-
}
2678+
convert_to_long_ex(pflags);
2679+
flags = Z_LVAL_PP(pflags);
2680+
if (flags && ((flags & ~(FT_UID|FT_INTERNAL|FT_PREFETCHTEXT)) != 0)) {
2681+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "invalid value for the options parameter");
2682+
RETURN_FALSE;
2683+
}
2684+
}
2685+
26572686

2658-
if ((myargc == 3) && (Z_LVAL_PP(flags) & FT_UID)) {
2687+
if ((myargc == 3) && (flags & FT_UID)) {
26592688
/* This should be cached; if it causes an extra RTT to the
26602689
IMAP server, then that's the price we pay for making sure
26612690
we don't crash. */
@@ -2666,7 +2695,7 @@ PHP_FUNCTION(imap_fetchheader)
26662695

26672696
PHP_IMAP_CHECK_MSGNO(msgindex);
26682697

2669-
RETVAL_STRING(mail_fetchheader_full(imap_le_struct->imap_stream, Z_LVAL_PP(msgno), NIL, NIL, (myargc == 3 ? Z_LVAL_PP(flags) : NIL)), 1);
2698+
RETVAL_STRING(mail_fetchheader_full(imap_le_struct->imap_stream, Z_LVAL_PP(msgno), NIL, NIL, (myargc == 3 ? Z_LVAL_PP(pflags) : NIL)), 1);
26702699
}
26712700
/* }}} */
26722701

@@ -2889,6 +2918,7 @@ PHP_FUNCTION(imap_fetch_overview)
28892918
ZEND_WRONG_PARAM_COUNT();
28902919
}
28912920

2921+
28922922
ZEND_FETCH_RESOURCE(imap_le_struct, pils *, streamind, -1, "imap", le_imap);
28932923

28942924
convert_to_string_ex(sequence);

0 commit comments

Comments
 (0)