Fix for infinite loop when trying to decode multi-part mime attachments

[squirrelmail.git] / class / mime / Message.class.php

diff --git a/class/mime/Message.class.php b/class/mime/Message.class.php
index 2db2a0f96610bb4c4cf6039e31df6ef935227b78..4e7dc48e8be1ef0bb08f5c541b06bae81fea8f5a 100644 (file)
--- a/class/mime/Message.class.php
+++ b/class/mime/Message.class.php
@@ -3,7 +3,7 @@
 /**
  * Message.class.php
  *
- * Copyright (c) 2002 The SquirrelMail Project Team
+ * Copyright (c) 2003 The SquirrelMail Project Team
  * Licensed under the GNU GPL. For full terms see the file COPYING.
  *
  * This contains functions needed to handle mime messages.
@@ -387,7 +387,7 @@ class Message {
                     $arg_a[] = $this->parseLiteral($read, $i);
                    /* temp bugfix (SM 1.5 will have a working clean version)
                       too much work to implement that version right now */
-                   --$i;
+//                 --$i;
                     ++$arg_no;
                     break;
                 case 'N':
@@ -443,9 +443,9 @@ class Message {
 
             $hdr->date = getTimeStamp($d); /* argument 1: date */
             $hdr->subject = $arg_a[1];     /* argument 2: subject */
-            $hdr->from = $arg_a[2][0];     /* argument 3: from        */
-            $hdr->sender = $arg_a[3][0];   /* argument 4: sender      */
-            $hdr->replyto = $arg_a[4][0];  /* argument 5: reply-to    */
+            $hdr->from = is_array($arg_a[2]) ? $arg_a[2][0] : '';     /* argument 3: from        */
+            $hdr->sender = is_array($arg_a[3]) ? $arg_a[3][0] : '';   /* argument 4: sender      */
+            $hdr->replyto = is_array($arg_a[4]) ? $arg_a[4][0] : '';  /* argument 5: reply-to    */
             $hdr->to = $arg_a[5];          /* argument 6: to          */
             $hdr->cc = $arg_a[6];          /* argument 7: cc          */
             $hdr->bcc = $arg_a[7];         /* argument 8: bcc         */
@@ -465,6 +465,9 @@ class Message {
           /* Now read the literal */
           $s = ($lit_cnt ? substr($read,$i,$lit_cnt): '');
           $i += $lit_cnt;
+          /* temp bugfix (SM 1.5 will have a working clean version)
+             too much work to implement that version right now */
+          --$i;
        } else { /* should never happen */
           $i += 3; /* } + \r + \n */
           $s = '';
@@ -477,12 +480,16 @@ class Message {
        $iPos = ++$i;
        while (true) {
           $iPos = strpos($read,'"',$iPos);
-          if ($iPos === false) break;
+          if (!$iPos) break;
           if ($iPos && $read{$iPos -1} != '\\') {
              $s = substr($read,$i,($iPos-$i));
              $i = $iPos;
              break;
           }
+       $iPos++;
+       if ($iPos > strlen($read)) {
+          break;
+       }
        }
         return $s;
     }