Bug 63542 (patch via Gabor Vizi)

johnj · johnj · commit 8aa8c3d5195a · 2012-12-01T13:25:28.000Z
diff --git a/mailparse.c b/mailparse.c
@@ -1081,6 +1081,8 @@ PHP_FUNCTION(mailparse_msg_parse_file)
 		int got = php_stream_read(stream, filebuf, MAILPARSE_BUFSIZ);
 		if (got > 0)	{
 			if (FAILURE == php_mimepart_parse(part, filebuf, got TSRMLS_CC)) {
+				/* We have to destroy the already allocated part, if we not return it */
+				php_mimepart_free(part TSRMLS_CC);
 				RETVAL_FALSE;
 				break;
 			}
diff --git a/php_mailparse_mime.c b/php_mailparse_mime.c
@@ -722,7 +722,19 @@ PHP_MAILPARSE_API int php_mimepart_parse(php_mimepart *part, const char *buf, si
 		if (len < bufsize && buf[len] == '\n') {
 			++len;
 			smart_str_appendl(&part->parsedata.workbuf, buf, len);
-			php_mimepart_process_line(part TSRMLS_CC);
+			if (php_mimepart_process_line(part TSRMLS_CC) == FAILURE) {
+				/* php_mimepart_process_line() only returns FAILURE in case the count of children
+				 * have exceeded MAXPARTS and doing so at the very begining, without doing any work.
+				 * It'd do this for all of the following lines, since the exceeded state won't change.
+				 * As no additional work have been done since the last php_mimepart_process_line() call, 
+				 * it is safe to break the loop now not caring about the rest of the code.
+				 * 
+				 * Known issues:
+				 *  - some callers aren't obeying the returned value, but that's in the mailmessage 
+				 *    object which is not documented and seemingly otdated/unfinished anyway
+				 */
+				return FAILURE;
+			};
 			part->parsedata.workbuf.len = 0;
 		} else {
 			smart_str_appendl(&part->parsedata.workbuf, buf, len);
