Re: cvs: /php3/functions imap.c

> > Quoting Mark Musone <musone@edgeglobal.com>: > > > I dont think this is a good idea. > > it's a huge security risk not using the strn* functions. > > If you've got a better way to check the string, I'll all ears. But this does > cause it to handle things correctly for me, where the old behavior segfaulted. i'd like to duplicate the problem and get a better solution. I dont wan to be on bugtraq tomorrow.. > > > I also dont get why body->CONTENT_MSG_BODY in the if statement should cause it to > > crash.. > > That doesn't make sense to me, either, but it was very much reproducible. > > > the point in it being in the if statement was that only the newer c-client's > > has a definitio for CONTENT_MSG_BODY, so by not checking it and just > > blindly assigning it, it caused some other seg faults.. > > The definition for CONTENT_MSG_BODY is actually in our imap.c file, and it > points at different things for different versions of c-client, so I have a > feeling it's taken care of there. > Yea...i agree, but i do remember specifically adding the CONTENT_MSG_BODY in the if statemnt to fix a seg fault..i'm going to go through the cvs logs and see when and why.. > > is there a chance of getting some sample messages that exhibits the seg fault? > > I just bounced you a message with a message/rfc822-headers part. It should > cause a crash without the strcasecmp change. > I'll take a look tonight..thanks.. Mark