[PECL-CVS] [pecl-mail-mailparse] master: Fix memory leak when a plain parameter repeats an RFC2231 name

Author: Ilia Alshanetsky (iliaal)
Committer: Remi Collet (remicollet)
Date: 2026-06-24T10:11:35+02:00

Commit: https://github.com/php/pecl-mail-mailparse/commit/7fbb274298576941550ba40599dde26a198344eb
Raw diff: https://github.com/php/pecl-mail-mailparse/commit/7fbb274298576941550ba40599dde26a198344eb.diff

Fix memory leak when a plain parameter repeats an RFC2231 name

Changed paths:
  A  tests/rfc2231_duplicate_plain_name.phpt
  M  php_mailparse_mime.c


Diff:

diff --git a/php_mailparse_mime.c b/php_mailparse_mime.c
index 13caa99..5e8e5bf 100644
--- a/php_mailparse_mime.c
+++ b/php_mailparse_mime.c
@@ -267,6 +267,11 @@ static struct php_mimeheader_with_attributes *php_mimeheader_alloc_from_tok(php_
 						}
 
 						namechanged = 0;
+					} else if (name && name != name_buf) {
+						/* plain parameter repeating the active RFC2231 name
+						 * (a separate allocation from name_buf): free the name
+						 * that would otherwise leak */
+						efree(name);
 					}
 				} else {
 					add_assoc_string(&attr->attributes, name, value);
diff --git a/tests/rfc2231_duplicate_plain_name.phpt b/tests/rfc2231_duplicate_plain_name.phpt
new file mode 100644
index 0000000..cbb54d1
--- /dev/null
+++ b/tests/rfc2231_duplicate_plain_name.phpt
@@ -0,0 +1,20 @@
+--TEST--
+A plain parameter repeating an RFC2231 encoded name does not leak the name
+--SKIPIF--
+<?php if (!extension_loaded("mailparse")) print "skip"; ?>
+--FILE--
+<?php
+/* "URL*0=a" opens an RFC2231 continuation named URL; the following plain
+ * "URL=b" repeats that base name. The duplicate name string used to leak. */
+$m = mailparse_msg_create();
+mailparse_msg_parse($m, "Content-Type: text/plain; URL*0=\"a\"; URL=\"b\"\r\n\r\nbody\r\n");
+$d = mailparse_msg_get_part_data($m);
+var_dump($d["content-type"]);
+var_dump($d["content-url"]);
+mailparse_msg_free($m);
+echo "done\n";
+?>
+--EXPECT--
+string(10) "text/plain"
+string(1) "a"
+done