com php-src: Fixed bug #73418 Integer Overflow in "_php_i map_mail" leads to crash: ext/imap/php_imap.c
| From: | Anatol Belski | Date: | Thu, 03 Nov 2016 16:09:03 +0000 |
| Subject: | com php-src: Fixed bug #73418 Integer Overflow in "_php_i map_mail" leads to crash: ext/imap/php_imap.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-95436@lists.php.net to get a copy of this message | ||
Commit: de643586dee986ff16c0a6be44813687786aa781
Author: Anatol Belski <ab@php.net> Thu, 3 Nov 2016 17:03:23 +0100
Parents: 5693474997b5a804be307583fb7bc3cfcdd50aec
Branches: PHP-7.0 PHP-7.1 master
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=de643586dee986ff16c0a6be44813687786aa781
Log:
Fixed bug #73418 Integer Overflow in "_php_imap_mail" leads to crash
(cherry picked from commit 99b242a6d093bca1f64084866b4491061de57553)
Bugs:
https://bugs.php.net/73418
Changed paths:
M ext/imap/php_imap.c
Diff:
diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 566392f..48229b5 100644
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -3934,7 +3934,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char
*
char *tsm_errmsg = NULL;
ADDRESS *addr;
char *bufferTo = NULL, *bufferCc = NULL, *bufferBcc = NULL, *bufferHeader = NULL;
- int offset, bufferLen = 0;
+ size_t offset, bufferLen = 0;
size_t bt_len;
if (headers) {