Fix #80220: imap_mail_compose() may leak memory

cmb69 · cmb69 · commit 0d022ddf03c5 · 2020-10-12T13:31:30.000+02:00
Unless `topbod` is of `TYPEMULTIPART`, `mail_free_body()` does not free the `nested.part`; while we could do this ourselves, instead we just ignore additional bodies in this case, i.e. we don't attach them in the first place. Closes GH-6321.
diff --git a/NEWS b/NEWS
@@ -12,6 +12,7 @@ PHP                                                                        NEWS
 - IMAP:
   . Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies). (cmb)
   . Fixed bug #80215 (imap_mail_compose() may modify by-val parameters). (cmb)
+  . Fixed bug #80220 (imap_mail_compose() may leak memory). (cmb)
 
 - MySQLnd:
   . Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with
diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
@@ -3714,7 +3714,7 @@ PHP_FUNCTION(imap_mail_compose)
 				convert_to_string_ex(pvalue);
 				bod->md5 = cpystr(Z_STRVAL_P(pvalue));
 			}
-		} else if (Z_TYPE_P(data) == IS_ARRAY) {
+		} else if (Z_TYPE_P(data) == IS_ARRAY && topbod->type == TYPEMULTIPART) {
 			short type = -1;
 			SEPARATE_ARRAY(data);
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type", sizeof("type") - 1)) != NULL) {

Original file line number	Diff line number	Diff line change
`@@ -3714,7 +3714,7 @@ PHP_FUNCTION(imap_mail_compose)`
`3714`	`3714`	`convert_to_string_ex(pvalue);`
`3715`	`3715`	`bod->md5 = cpystr(Z_STRVAL_P(pvalue));`
`3716`	`3716`	`}`
`3717`		`- } else if (Z_TYPE_P(data) == IS_ARRAY) {`
	`3717`	`+ } else if (Z_TYPE_P(data) == IS_ARRAY && topbod->type == TYPEMULTIPART) {`
`3718`	`3718`	`short type = -1;`
`3719`	`3719`	`SEPARATE_ARRAY(data);`
`3720`	`3720`	`if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "type", sizeof("type") - 1)) != NULL) {`