Subject: segfault in RC7 (and prior) and a fix

From: [email-masked]
Date: Thu, 10 Oct 2002 18:13:10 -0400

I've found a segfault condition with extremely large header fields (100+
BCC entries.  Yes, BCC, it was a malformed spam).  This exists in RC7 and
to the best of my testing, prior versions.  Any program (ie, PHP) linking 
to c-client will segfault when it encounters an invalid email of this type.

The problem lies in the parsing done by imap_parse_string in 
c-client/imap4r1.c:4123.

The test:
      if (!c || (c & 0x80)) {   /* server bogon */
looks for c == 0, end of string as well as invalid characters, however it
then does a loop, incrementing past the end of the array.  The quick and
dirty fix is to add:

---
      if (!c || (c & 0x80)) {   /* server bogon */
    sprintf (LOCAL->tmp,"Invalid CHAR in quoted string: %x",
         (unsigned int) c);
    mm_log (LOCAL->tmp,WARN);

+        /* URMK - hacked in to try to prevent a crashing bug... */
+        if (c == 0)
+            break;

    do {            /* search for end with no further check */
---

This solves the crash and returns an error.  There may be a more appropriate
way to handle it.

This showed up under linux/390 with spam mails with very long header fields
and IBM's VM IMAP server.  

-m

-- 
Michael Kershaw
[email-masked]
Linux Systems Programmer, Information Technology

"Don't worry, I'm sure they'll listen to Reason." -- Fisheye, Snowcrash
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Thu, 10 Oct 2002 15:51:46 -0700 (Pacific Daylight Time)

Thank you for this report.

The actual problem is an IMAP server bug.  Either the IMAP server sent an
unterminated quoted string, or it sent a NUL within a quoted string.
Either of these is a violation of the IMAP protocol.

I agree that c-client's IMAP client code should not crash due to an buggy
IMAP server, and there will be a fix in place in the released version of
imap-2002 (and RC8 if there is such).

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.