bugThe nmh Mail Handling System - Bugs: bug #9721, inc core dump in matchc() w/ill...

 
 

bug #9721: inc core dump in matchc() w/ill formatted mail

Submitter:  None
Submitted:  Wed 21 Jul 2004 07:44:58 PM UTC
   
 
Category:  Documentation Severity:  3 - Normal
Priority:  * 5 - Normal Status:  Fixed
Assigned to:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 09 Nov 2005 10:29:48 PM UTC, comment #4: 

sorry, can't drive this BTS yet; you have to mark it 'fixed' and 'closed'...

Peter Maydell <pm215>
Group administrator
Wed 09 Nov 2005 10:27:50 PM UTC, comment #3: 

I think that the problem this bug's patch fixes was fixed in this checkin:

sbr/m_getfld.c revision 1.7 Sun May 28 12:45:53 2000 UTC (5 years, 5 months ago) by ruud

>Fixed m_getfld bug which caused segmentation faults when
>incorporating messages which ended in multiple linefeeds crossing
>a buffer boundary.


(I think that was a bit ugly; but the long term fix is to replace matchc() with a Boyer-Moore search or something -- the only reason it's the way it is is because on a VAX you can do matchc() in one instruction...)

So I'm closing this bug.

Peter Maydell <pm215>
Group administrator
Mon 26 Jul 2004 09:01:31 PM UTC, comment #2: 

Upon request from a downstream bug: http://bugs.gentoo.org/show_bug.cgi?id=57886

I made up a sample file which replicates the problem.  I (through the agency of someone else trying to replicate the bug) also discovered that you need to use a special argument to inc to have the problem (-audit)

Seth Robertson <in-gnu_baka_org>
Wed 21 Jul 2004 07:45:49 PM UTC, comment #1: 

Here is the second patch I promised

Anonymous
Wed 21 Jul 2004 07:44:58 PM UTC, original submission:  

I was innocently attempting to read email today and was unable to
`inc` my mail--getting a core dump.  After jumping through many many
hoops so that I could debug the problem, I discovered that there was a
bug in matchc() which could cause ill-formatted email to overrun
buffers.  I don't think it could be abused to execute arbitrary
commands, at least in the context I saw it operating, but I hope you
agree that it must be fixed ASAP regardless.

The specific bug is that matchc() only checks to see if the string
being searched is out of bounds when the character in the search
string is NOT the first character of the pattern:

m_getfld.c: 730
 for(;;)
    while (pc != *str++)
      if (str > es)
        return 0;

The implication is if the search string ends with a lot of these
pattern characters, it will happily run past the end (es).  If, as it
happened in my case, the pattern does happen to appear after es, the
function will return an address greater than es.  This larger address
will be used for a length computation (m_getfld.c: 446) passed into
memcpy (m_getfld.c: 486), and will thus overrun the destination
buffer.

Changing the test so that it always tests str > es fixed the bug.  I
did a little dance with where the increment occurs to prevent the
logic from being any more complex than necessary.  I'll actually
provide two patches below.  One minimal, one more clean (IMHO of course).

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #1602:  sample.1 added by in-gnu_baka_org (73KiB - application/octet-stream - Example mbox to replicate problem)
file #1572:  p2 added by None (524B - application/octet-stream - More clean patch)
file #1571:  p1 added by None (423B - application/octet-stream - Minimal patch)

 

Depends on the following items: None found

Items that depend on this one

Digest:
   bug dependencies.

 

CC list is empty

 

Follow 7 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2005-11-09 pm215 Open/ClosedOpen Closed
2005-11-09 pm215 StatusNone Fixed
2005-11-09 bress Dependencies- bugs #14940 is dependent
2004-07-26 in-gnu_baka_org Attached File- Added sample.1, #1535
2004-07-21 in-gnu_baka_org Carbon-Copy- Added in-gnu_baka_org
2004-07-21 None Attached File- Added p2, #1510
2004-07-21 None Attached File- Added p1, #1509

Back to the top

Powered by Savane 3.13-3230.
Corresponding source code