Re: PHP 4.0.6 IMAP BUG
| From: | Markus Fischer | Date: | Thu, 20 Dec 2001 09:32:43 +0000 |
| Subject: | Re: PHP 4.0.6 IMAP BUG | ||
| References: | 1 2 3 | Groups: | php.dev |
| Request: | Send a blank email to php-dev+get-74549@lists.php.net to get a copy of this message | ||
On Wed, Dec 19, 2001 at 12:35:09PM -0500, Jon Parise wrote :
> On Wed, Dec 19, 2001 at 05:35:53PM +0100, Markus Fischer wrote:
>
> > Verified with latest CVS. No time do dig in right now, but note
> > the crash occurs in the imap library:
>
> Please forward the test case and your backtrace to the c-client
> mailing list:
>
> http://www.washington.edu/imap/c-client-list.html
Glad I didn't, its a bug in ext/imap. Due the pointer
juggling we're accidantly calling fs_free() on something
which was never explicetely malloced. I've a patch here which
takes care of this but I'm not too familiar with imap code.
- Markus
--
Please always Cc to me when replying to me on the lists.
Index: php_imap.c =================================================================== RCS file: /repository/php4/ext/imap/php_imap.c,v retrieving revision 1.110 diff -u -r1.110 php_imap.c --- php_imap.c 11 Dec 2001 15:29:37 -0000 1.110 +++ php_imap.c 20 Dec 2001 09:20:22 -0000 @@ -3466,6 +3466,7 @@ char *string, *charset, encoding, *text, *decode; long charset_token, encoding_token, end_token, end, offset=0, i; unsigned long newlength; + zend_bool use_imap_free; if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &str) == FAILURE) { ZEND_WRONG_PARAM_COUNT(); @@ -3505,11 +3506,14 @@ memcpy(text, &string[encoding_token + 3], end_token - (encoding_token + 3)); /* Extract text */ text[end_token - (encoding_token + 3)] = 0x00; decode = text; + use_imap_free = 1; if (encoding == 'q' || encoding == 'Q') { /* Decode 'q' encoded data */ for(i=0; text[i] != 0x00; i++) if (text[i] == '_') text[i] = ' '; /* Replace all *_' with space. */ decode = (char *)rfc822_qprint((unsigned char *) text, strlen(text), &newlength); } else if (encoding == 'b' || encoding == 'B') { decode = (char *)rfc822_base64((unsigned char *) text, strlen(text), &newlength); /* Decode 'B' encoded data */ + } else { + use_imap_free = 0; } if (decode == NULL) { efree(charset); @@ -3521,7 +3525,9 @@ add_property_string(myobject, "charset", charset, 1); add_property_string(myobject, "text", decode, 1); zend_hash_next_index_insert(Z_ARRVAL_P(return_value), (void *)&myobject, sizeof(zval *), NULL); - fs_give((void**)&decode); + if (use_imap_free) { + fs_give((void**)&decode); + } offset = end_token+2; for (i = 0; (string[offset + i] == ' ') || (string[offset + i] == 0x0a) || (string[offset + i] == 0x0d); i++);
Index: php_imap.c =================================================================== RCS file: /repository/php4/ext/imap/php_imap.c,v retrieving revision 1.110 diff -u -r1.110 php_imap.c --- php_imap.c 11 Dec 2001 15:29:37 -0000 1.110 +++ php_imap.c 20 Dec 2001 09:20:22 -0000 @@ -3466,6 +3466,7 @@ char *string, *charset, encoding, *text, *decode; long charset_token, encoding_token, end_token, end, offset=0, i; unsigned long newlength; + zend_bool use_imap_free; if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &str) == FAILURE) { ZEND_WRONG_PARAM_COUNT(); @@ -3505,11 +3506,14 @@ memcpy(text, &string[encoding_token + 3], end_token - (encoding_token + 3)); /* Extract text */ text[end_token - (encoding_token + 3)] = 0x00; decode = text; + use_imap_free = 1; if (encoding == 'q' || encoding == 'Q') { /* Decode 'q' encoded data */ for(i=0; text[i] != 0x00; i++) if (text[i] == '_') text[i] = ' '; /* Replace all *_' with space. */ decode = (char *)rfc822_qprint((unsigned char *) text, strlen(text), &newlength); } else if (encoding == 'b' || encoding == 'B') { decode = (char *)rfc822_base64((unsigned char *) text, strlen(text), &newlength); /* Decode 'B' encoded data */ + } else { + use_imap_free = 0; } if (decode == NULL) { efree(charset); @@ -3521,7 +3525,9 @@ add_property_string(myobject, "charset", charset, 1); add_property_string(myobject, "text", decode, 1); zend_hash_next_index_insert(Z_ARRVAL_P(return_value), (void *)&myobject, sizeof(zval *), NULL); - fs_give((void**)&decode); + if (use_imap_free) { + fs_give((void**)&decode); + } offset = end_token+2; for (i = 0; (string[offset + i] == ' ') || (string[offset + i] == 0x0a) || (string[offset + i] == 0x0d); i++);