#24150 [Asn->Csd]: imap_fetch_overview crashes with a very big address in From:

ID: 24150 Updated by: iliaa@php.net Reported By: nuno at co dot sapo dot pt -Status: Assigned +Status: Closed Bug Type: IMAP related Operating System: Linux 2.4.x PHP Version: 4.3.2 Assigned To: iliaa New Comment: This bug has been fixed in CVS. In case this was a PHP problem, snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. In case this was a documentation problem, the fix will show up soon at http://www.php.net/manual/. In case this was a PHP.net website problem, the change will show up on the PHP.net site and on the mirror sites in short time. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2003-06-16 09:28:35] nuno at co dot sapo dot pt No, I didn't recompile it with --enable-debug. With PHP 4.3.2 I used an hacked c-client. *But* before I submitted the bug I tryed it in my laptop which runs PHP 4.2.3 installed via apt-get and it also segfaulted. $ dpkg -l php* | grep IMAP ii php4-imap 4.2.3-9 IMAP module for php4 $ dpkg -S /usr/include/c-client/mail.h libc-client2001-dev: /usr/include/c-client/mail.h ------------------------------------------------------------------------ [2003-06-16 09:09:32] nuno at co dot sapo dot pt Checking imap_fetch_overview() function source code (php_imap.c, line 2666) we can see that the address variable is an array with a length of MAILTMPLEN (defined in phplib as 1024, I think). Well, this from address has around 10k length, so seems obvious what's happening. Why doesn't php truncate the from address as it does in imap_headerinfo() ? Note: This is just speculation. I'm not really sure about what I'm talking about since I never looked at the php sources, and don't code C for some years now. :) ------------------------------------------------------------------------ [2003-06-16 08:40:19] sniper@php.net Did you configure PHP with --enable-debug?? If not, please do it. And remember to delete config.cache before running configure again. Also, which c-client version are you using? ------------------------------------------------------------------------ [2003-06-16 08:33:38] nuno at co dot sapo dot pt (gdb) bt #0 0x80ed07a in zif_imap_fetch_overview (ht=1717791080, return_value=0x6a756479, this_ptr=0x636e626b, return_value_used=1785165933) at /servers/sources/php-4.3.2/ext/imap/php_imap.c:224 #1 0x65796866 in ?? () Cannot access memory at address 0x736f6a70. (gdb) ------------------------------------------------------------------------ [2003-06-12 09:59:48] sniper@php.net Thank you for this bug report. To properly diagnose the problem, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". Thank you for helping us make PHP better. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/24150 -- Edit this bug report at http://bugs.php.net/?id=24150&edit=1