PHP IMAP segfault

[John Dalbec]

On Wed, 30 Nov 2005 12:52:46 -0700 Michal Jaegermann wrote:

> 0x62656420 actually spells " deb" (little endian) and 0x67696c61
> is "alig".  Sounds suspiciously like
> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=170411
> which you actually posted with that exception that depending on
> what distro you are using it may be either imap or libc-client
> libraries (or maybe php has a copy of this code?). So you may want
> to look as well at
> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=170521
> 
> Clearly this may be a wrong guess.
> 
>    Michal

I built IMAP with the mail.c patch and installed it, then I built PHP which 
should have incorporated the new libc-client.  I installed IMAP and PHP on a 
test server but I didn't upgrade the production IMAP server since I don't think 
this patch affects the imapd server.  Does it affect imapd?

In any case, the segfault I saw continues to occur.  The stack becomes corrupted 
after rfc822_write_address(address, env->to);

I think I can fix the problem by patching rfc822_parse_adrlist (which is called 
by mail_fetch_structure) to temporarily truncate each header to length 
MAILTMPLEN-1 before parsing.  I'll build and test packages before posting the patch.
Thanks,
John