Patch 0001-Fixed-bug-71397-mb_send_mail-segmentation-fault.patch for Reproducible crash Bug #71397

Patch version 2016-01-17 14:31 UTC

• 2016-01-17 14:31 UTC [diff to current]

Developer: public+php.net@bastelstu.be

From e585696a0b9d9eefefffa74249f751cfbe6e1222 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= <tim@bastelstu.be>
Date: Sun, 17 Jan 2016 15:03:47 +0100
Subject: [PATCH] Fixed bug 71397 (mb_send_mail segmentation fault)

---
 NEWS                    | 3 +++
 ext/mbstring/mbstring.c | 3 ++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index d18dada..5ebb263 100644
--- a/NEWS
+++ b/NEWS
@@ -34,6 +34,9 @@ PHP                                                                        NEWS
   . Fixed bug #71249 (ldap_mod_replace/ldap_mod_add store value as string
     "Array"). (Laruence)
 
+- Mbstring:
+  . Fixed bug #71397 (mb_send_mail segmentation fault). (Tim Düsterhus)
+
 - SOAP:
   . Fixed bug #70979 (crash with bad soap request). (Anatol)
   
diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index 4fdb3d5..b5812cb 100644
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -4145,9 +4145,10 @@ PHP_FUNCTION(mb_send_mail)
 		suppressed_hdrs.cnt_type = 1;
 	}
 
-	if ((s = zend_hash_str_find_ptr(&ht_headers, "CONTENT-TRANSFER-ENCODING", sizeof("CONTENT-TRANSFER-ENCODING") - 1))) {
+	if ((s = zend_hash_str_find(&ht_headers, "CONTENT-TRANSFER-ENCODING", sizeof("CONTENT-TRANSFER-ENCODING") - 1))) {
 		enum mbfl_no_encoding _body_enc;
 
+		ZEND_ASSERT(Z_TYPE_P(s) == IS_STRING);
 		_body_enc = mbfl_name2no_encoding(Z_STRVAL_P(s));
 		switch (_body_enc) {
 			case mbfl_no_encoding_base64:
-- 
2.7.0