#22048 [Fbk->Csd]: imap_header() crashes with bad To: or From: header

ID: 22048 Updated by: iliaa@php.net Reported By: rlineweaver@harrisonburg.k12.va.us -Status: Feedback +Status: Closed Bug Type: IMAP related Operating System: RedHat Linux 8.0 (2.4.18) PHP Version: 4CVS-2003-02-04 (stable) Assigned To: iliaa New Comment: This bug has been fixed in CVS. In case this was a PHP problem, snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. In case this was a documentation problem, the fix will show up soon at http://www.php.net/manual/. In case this was a PHP.net website problem, the change will show up on the PHP.net site and on the mirror sites in short time. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2003-02-11 12:30:16] iliaa@php.net Could you try the patch at: http://bb.prohost.org/imap.txt it should fix the problem. The solution you've proposed is not quite right, while may solve the problem in some cases it is only a temporary fix, E-mail address with couple a hundred \\ in it would still result in a crash. ------------------------------------------------------------------------ [2003-02-04 10:40:33] rlineweaver@harrisonburg.k12.va.us This is a very similar issue to bug #19280 (http://bugs.php.net/bug.php?id=19280), but that bug was closed and this issue still exists. php4-STABLE-200302041230 imap-2001a (from RedHat 8.0) apache-2.0.44 (happens from CLI too, so probably irrelevant) also occurs with php-4.3.0, apache-2.0.43 Strangely constructed To: or From: header causes a segfault, even from CLI php. Here are sample headers to reconstruct the problem: --- From test@test.com Mon Feb 3 14:08:06 2003 Return-Path: <test@test.com> Date: Mon, 3 Feb 2003 14:08:08 -0500 From: PHP Test Case <test@test.com> To: \\\\\\\\\\\\\\\\\\\ <t@t.com> Subject: test 4 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit --- Swapping the To: and From: headers causes the same problem. The following script will reproduce the segfault: --- <?php $mailbox = imap_open( "{127.0.0.1:143/imap/notls}"."test", "rob", "******", OP_READONLY); $header = imap_header($mailbox, 1); echo $header->toaddress . "\n"; echo $header->fromaddress . "\n"; imap_close($mailbox); ?> --- Notes: In ext/imap/php_imap.c, if I change the define: #define PHP_IMAP_ADDRESS_SIZE_BUF 10 to something larger, say 100, the segfault disappears. Since PHP_IMAP_ADDRESS_SIZE_BUF was added to solve bug #19280 I thought this may be a related issue. The badly constructed address above (\\\\\\\\\\\\\\\\\\\ <t@t.com>) was the shortest test case I could come up with. Note that reducing the number of backslashes makes it work, but adding the same number of alphanumeric characters back into the email address itself (between the <>) breaks it again. An older server running PHP 4.1.2, imap-2001a, Apache 1.3.27, Horde/IMP, was not affected by the same messages. Thanks for looking into this! Let me know if you need additional information. PHP ./configure line pasted below: './configure' '--prefix=/usr/local/php4-STABLE-200302041230' '--with-config-file-path=/etc' '--enable-force-cgi-redirect' '--disable-debug' '--enable-pic' '--disable-rpath' '--enable-inline-optimization' '--with-bz2' '--with-db4' '--with-zlib' '--with-gd' '--with-png-dir=/usr' '--with-freetype-dir=/usr' '--enable-gd-native-ttf' '--with-ttf' '--with-gdbm' '--with-gettext' '--with-ncurses' '--with-gmp' '--with-iconv' '--with-jpeg-dir=/usr' '--with-png' '--with-pspell' '--with-regex=system' '--with-xml' '--with-expat-dir=/usr' '--enable-bcmath' '--enable-exif' '--enable-ftp' '--enable-magic-quotes' '--enable-safe-mode=no' '--enable-sockets' '--enable-sysvsem' '--enable-sysvshm' '--enable-discard-path' '--enable-track-vars' '--enable-trans-sid' '--without-oci8' '--with-pear=/usr/share/pear' '--with-imap=shared' '--with-imap-ssl' '--with-ldap=shared' '--with-mysql=shared,/usr' '--enable-memory-limit' '--enable-bcmath' '--enable-shmop' '--enable-versioning' '--with-apxs2=/usr/local/apache-2.0.44/bin/apxs' '--with-kerberos=/usr/kerberos' ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=22048&edit=1