249675 - IMAP parser: multi-line quoted strings can crash mozilla

Status: RESOLVED FIXED

(MailNews Core :: Networking: IMAP, defect)

Description

[Hans-Andreas Engel]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040622
Build Identifier: 

In |nsIMAPGenericParser::CreateQuoted|, quoted strings which stretch over
several lines (e.g. "multi-\r\nline") are not handled correctly. This leads to
illegal pointers in |nsIMAPGenericParser| and eventually to a crash.

Note that such quoted strings, containing CR or LF, violate the IMAP standard.

Reproducible: Always
Steps to Reproduce:

Comment 1

[Hans-Andreas Engel]

In |CreateQuoted()|, when the end of the quoted string is found, the offsets of
the current-line strings used for parsing must be adjusted.  The current code
uses |returnString.Length()| as offset.  However, |returnString| could result as
a concatenation of several input lines.  This offset is then used on the current
line, which might be much shorter.  Consequently, |fCurrentTokenPlaceHolder|
might be shifted to invalid memory regions!  Moreover,
|*fCurrentTokenPlaceHolder| will be accessed (and possibly overwritten) just in
the following line.

The memory error occurs in
500       fCurrentTokenPlaceHolder += escapeCharsCut + charIndex + 1 -
strlen(fNextToken);
501       if (!*fCurrentTokenPlaceHolder)

Comment 2

[Hans-Andreas Engel]

Testing nsIMAPGenericParser with a multi-line quoted string leads to a segfault,
as expected.

Comment 3

[Hans-Andreas Engel]

Are there IMAP servers which return LFs in quoted strings (violating the
standards)?  If so, we should fix the code which adjusts the tokenizer offsets
in |CreateQuoted()|.  Otherwise, we should enforce the IMAP standard for strings
containing LFs and flagging a syntax error.

Comment 4

[Hans-Andreas Engel]

Attachment: fix: flagging a syntax error for quoted strings containing CRLF

Comment 5

[Hans-Andreas Engel]

Attachment: imap server emulation which crashes mozilla clients

Run this perl script, then create mozilla IMAP account on localhost, port 14343

(any username/password).  

Trying to read mail from this account then _crashes_ mozilla.  This is due to
this bug and because the perl script sends multi-line quoted strings to
mozilla.

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Confirming, since it has a patch and a well-filed bug.

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

Confirming, since it has a patch and a well-filed bug.

Comment 8

[David :Bienvenu]

Comment on attachment 152243 [details] [diff] [review]
fix: flagging a syntax error for quoted strings containing CRLF

thx, Hans, sorry for the delay...

Comment 9

[Dan Mosedale (:dmosedale, :dmose)]

Comment on attachment 152243 [details] [diff] [review]
fix: flagging a syntax error for quoted strings containing CRLF

sr=dmose

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

timeless landed this:

Bug 249675 IMAP parser: multi-line quoted strings can crash mozilla
patch by [e-mail] r=bienvenu sr=dmose