#22638 [NEW]: Using Horde/IMP to read an email causes a crash

From: dsilvers at pepperfish dot net Operating system: Linux PHP version: 4.3.1 PHP Bug Type: Reproducible crash Bug description: Using Horde/IMP to read an email causes a crash When attempting to view an email from British Airways, Horde/IMP would cause a reliably reproducable segmentation fault in the zend hash implementation. I have worked the minimum-tripping example to: ---CUT From user@otherdomain.com Mon Mar 10 17:23:48 2003 From: <user@otherdomain.com> To: <user@domain.example> CC: <> Reply-To: <user@domain.com> Subject: Crashy email This email crashes IMP ---CUT The guys at horde.org say it's a PHP problem and that I should ask you guys to solve it. If you could, I'd be very very grateful -- I have several customers whose email is very affected by this bug. It appears that the bug is provoked by the adding of the odd CC header into the hash table of headers maintained by the IMAP code. Here is a GDB backtrace of it happening in 4.3.1 release: Program received signal SIGSEGV, Segmentation fault. 0x402d2998 in malloc () from /lib/libc.so.6 (gdb) bt #0 0x402d2998 in malloc () from /lib/libc.so.6 #1 0x402d2074 in malloc () from /lib/libc.so.6 #2 0x0811d53c in _emalloc (size=53) at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_alloc.c:154 #3 0x0812d126 in zend_hash_add_or_update (ht=0x833a004, arKey=0x8159ee6 "mon_thousands_sep", nKeyLength=18, pData=0xbfff2118, nDataSize=4, pDest=0x0, flag=1) at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_hash.c:262 #4 0x0812b61c in add_assoc_string_ex (arg=0x828d864, key=0x8159ee6 "mon_thousands_sep", key_len=18, str=0x404a30c9 ",", duplicate=1) at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_API.c:673 #5 0x080d953d in zif_localeconv (ht=0, return_value=0x828d864, this_ptr=0x0, return_value_used=1) at /home/dsilvers/new-webmail/php-4.3.1/ext/standard/string.c:3766 #6 0x0813982a in execute (op_array=0x836253c) at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_execute.c:1598 #7 0x08139984 in execute (op_array=0x83639a4) at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_execute.c:1640 #8 0x08139984 in execute (op_array=0x8362a2c) at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_execute.c:1640 #9 0x08139984 in execute (op_array=0x824dcbc) at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_execute.c:1640 #10 0x0812a598 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend.c:864 #11 0x081087ef in php_execute_script (primary_file=0xbffffe48) at /home/dsilvers/new-webmail/php-4.3.1/main/main.c:1573 #12 0x08144a43 in main (argc=1, argv=0xbffffec4) at /home/dsilvers/new-webmail/php-4.3.1/sapi/cgi/cgi_main.c:1424 (gdb) quit Here's my configure line: ./configure --enable-fastcgi --with-pgsql --disable-ipv6 --with-imap --with-gettext --with-xml --with-mcrypt --prefix=/usr/local/webmail/php --with-imap-ssl --with-zlib --disable-safe-mode Here's info about the system: Linux salmon 2.4.18 #1 Thu Mar 14 19:06:39 GMT 2002 i686 unknown It's a duron 600 based system with plenty of free ram and swap. It is running Debian GNU/Linux 3.0r1 (Woody) with security patches PHP is compiled up from source. If there's any other information you need, just yell. D. -- Edit bug report at http://bugs.php.net/?id=22638&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=22638&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=22638&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=22638&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=22638&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=22638&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=22638&r=support Expected behavior: http://bugs.php.net/fix.php?id=22638&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=22638&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=22638&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=22638&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=22638&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=22638&r=dst IIS Stability: http://bugs.php.net/fix.php?id=22638&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=22638&r=gnused