[2016-09-30 09:10 UTC] minhrau dot vc dot 365 at gmail dot com

Description:
------------
integer overflow in function imap_8bit will cause string length > int max.

PHP_FUNCTION(imap_8bit)
{
	char *text, *decode;
	int text_len;
	unsigned long newlength;

	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &text, &text_len) == FAILURE) {
		return;
	}

	decode = (char *) rfc822_8bit((unsigned char *) text, text_len, &newlength); //here produce string with length > int max

	if (decode == NULL) {
		RETURN_FALSE;
	}

	RETVAL_STRINGL(decode, newlength, 1);
	fs_give((void**) &decode);

Test script:
---------------
<?php

ini_set('memory_limit', -1);


$str = str_repeat('ó', 0xffffffff/10); 

var_dump(strlen($str));
$str1 = imap_8bit($str);
var_dump(strlen($str1));
?>

Expected result:
----------------
String length < int max

Actual result:
--------------
negative length value