#24150 [Opn->Asn]: imap_fetch_overview crashes with a very big address in From:

ID: 24150 Updated by: iliaa@php.net Reported By: nuno at co dot sapo dot pt -Status: Open +Status: Assigned Bug Type: IMAP related Operating System: Linux 2.4.x PHP Version: 4.3.2 -Assigned To: +Assigned To: iliaa Previous Comments: ------------------------------------------------------------------------ [2003-06-16 09:28:35] nuno at co dot sapo dot pt No, I didn't recompile it with --enable-debug. With PHP 4.3.2 I used an hacked c-client. *But* before I submitted the bug I tryed it in my laptop which runs PHP 4.2.3 installed via apt-get and it also segfaulted. $ dpkg -l php* | grep IMAP ii php4-imap 4.2.3-9 IMAP module for php4 $ dpkg -S /usr/include/c-client/mail.h libc-client2001-dev: /usr/include/c-client/mail.h ------------------------------------------------------------------------ [2003-06-16 09:09:32] nuno at co dot sapo dot pt Checking imap_fetch_overview() function source code (php_imap.c, line 2666) we can see that the address variable is an array with a length of MAILTMPLEN (defined in phplib as 1024, I think). Well, this from address has around 10k length, so seems obvious what's happening. Why doesn't php truncate the from address as it does in imap_headerinfo() ? Note: This is just speculation. I'm not really sure about what I'm talking about since I never looked at the php sources, and don't code C for some years now. :) ------------------------------------------------------------------------ [2003-06-16 08:40:19] sniper@php.net Did you configure PHP with --enable-debug?? If not, please do it. And remember to delete config.cache before running configure again. Also, which c-client version are you using? ------------------------------------------------------------------------ [2003-06-16 08:33:38] nuno at co dot sapo dot pt (gdb) bt #0 0x80ed07a in zif_imap_fetch_overview (ht=1717791080, return_value=0x6a756479, this_ptr=0x636e626b, return_value_used=1785165933) at /servers/sources/php-4.3.2/ext/imap/php_imap.c:224 #1 0x65796866 in ?? () Cannot access memory at address 0x736f6a70. (gdb) ------------------------------------------------------------------------ [2003-06-12 09:59:48] sniper@php.net Thank you for this bug report. To properly diagnose the problem, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". Thank you for helping us make PHP better. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/24150 -- Edit this bug report at http://bugs.php.net/?id=24150&edit=1