#47736 [Ver->Asn]: imap_headerinfo() segfaults with large address lists

ID: 47736 Updated by: pajoye@php.net Reported By: etremblay at kronostechnologies dot com -Status: Verified +Status: Assigned Bug Type: IMAP related Operating System: * PHP Version: 5.*, 6CVS (2009-03-31) -Assigned To: +Assigned To: pajoye New Comment: We still use some of the risky APIs. Testing again before the commit. Previous Comments: ------------------------------------------------------------------------ [2009-03-31 11:49:40] etremblay at kronostechnologies dot com If you look closely at http://markmail.org/message/ypvowfyqcijit4f5, it say that the fixed api functions begin with rfc822_output_*. In the core dump, we see that the problem is in the function rfc822_output_address () from /usr/lib/libc-client.so.2007b. So, the actual problem is not the same. ------------------------------------------------------------------------ [2009-03-31 07:55:38] jani@php.net This explains the bug: http://markmail.org/message/ypvowfyqcijit4f5 ------------------------------------------------------------------------ [2009-03-23 12:22:38] etremblay at kronostechnologies dot com libc-client2007b (ubuntu intrepid) I try the current snapshot of php. Post back in 2 minutes. ------------------------------------------------------------------------ [2009-03-23 12:16:27] pajoye@php.net Which imap version do you use? ------------------------------------------------------------------------ [2009-03-23 12:14:50] etremblay at kronostechnologies dot com Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb757e700 (LWP 21722)] 0xb7e7fbb6 in memcpy () from /lib/tls/i686/cmov/libc.so.6 (gdb) bt #0 0xb7e7fbb6 in memcpy () from /lib/tls/i686/cmov/libc.so.6 #1 0xbf877e84 in ?? () #2 0xb6c72d42 in ?? () from /usr/lib/libc-client.so.2007b #3 0xb6c738b3 in rfc822_output_address () from /usr/lib/libc-client.so.2007b #4 0xb6c73abd in rfc822_output_address_list () from /usr/lib/libc-client.so.2007b #5 0xb6f9a0ea in _php_rfc822_write_address (addresslist=0xb8ccc6f8) at /opt/php-5.2.9/ext/imap/php_imap.c:3947 #6 0x0061632e in ?? () Backtrace stopped: previous frame inner to this frame (corrupt stack?) ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/47736 -- Edit this bug report at http://bugs.php.net/?id=47736&edit=1