Debian Bug report logs - #313306
mailx: Crashes when command line contains many digits

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Ulf Harnhammar <metaur@telia.com>

To: submit@bugs.debian.org

Subject: mailx: Crashes when command line contains many digits

Date: Mon, 13 Jun 2005 01:27:14 +0200

[Message part 1 (text/plain, inline)]

Subject: mailx: Crashes when command line contains many digits
Package: mailx
Version: 1:8.1.2-0.20040524cvs-4
Severity: normal
Tags: patch

Hello,

mailx crashes when you give it a command line containing thousands of digits,
as shown in this example:


metaur@metaur:~/mailx-bug$ perl -e 'print "9"x2150, "\n";' | /usr/bin/mailx -f mailbox
Mail version 8.1.2 01/15/2001.  Type ? for help.
"mailbox": 1 message
>   1 metaur@localhost.  Sun May 29 01:52   18/592   hi
-1: Invalid message number
"Source" stack over-pop.
Segmentation fault
metaur@metaur:~/mailx-bug$


This crash is caused by a buffer overflow. I see no security implications of this bug,
since that part of the code deals with data from the user and not data from e-mail
messages and since it only copies digits anyway. It is still worth fixing to improve
quality and stability.

I have attached a patch and the mailbox I used in the example above (it should work
with any mailbox file, though).

// Ulf Harnhammar

-- System Information:
Debian Release: 3.1
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.8-2-686
Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1)

Versions of packages mailx depends on:
ii  base-files                  3.1.2        Debian base system miscellaneous f
ii  exim4                       4.50-8       metapackage to ease exim MTA (v4) 
ii  exim4-daemon-light [mail-tr 4.50-8       lightweight exim MTA (v4) daemon
ii  libc6                       2.3.2.ds1-22 GNU C Library: Shared libraries an
ii  liblockfile1                1.06         NFS-safe locking library, includes

-- no debconf information

[mailx.digit_bufoflow.patch (text/plain, attachment)]

[mailbox (text/plain, attachment)]

Message #10 received at 313306-close@bugs.debian.org (full text, mbox, reply):

From: Robert Luberda <robert@debian.org>

To: 313306-close@bugs.debian.org

Subject: Bug#313306: fixed in mailx 1:8.1.2-0.20050715cvs-1

Date: Thu, 14 Jul 2005 19:49:45 -0400

Source: mailx
Source-Version: 1:8.1.2-0.20050715cvs-1

We believe that the bug you reported is fixed in the latest version of
mailx, which is due to be installed in the Debian FTP archive:

mailx_8.1.2-0.20050715cvs-1.diff.gz
  to pool/main/m/mailx/mailx_8.1.2-0.20050715cvs-1.diff.gz
mailx_8.1.2-0.20050715cvs-1.dsc
  to pool/main/m/mailx/mailx_8.1.2-0.20050715cvs-1.dsc
mailx_8.1.2-0.20050715cvs-1_i386.deb
  to pool/main/m/mailx/mailx_8.1.2-0.20050715cvs-1_i386.deb
mailx_8.1.2-0.20050715cvs.orig.tar.gz
  to pool/main/m/mailx/mailx_8.1.2-0.20050715cvs.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 313306@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Robert Luberda <robert@debian.org> (supplier of updated mailx package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Fri, 15 Jul 2005 00:28:33 +0200
Source: mailx
Binary: mailx
Architecture: source i386
Version: 1:8.1.2-0.20050715cvs-1
Distribution: unstable
Urgency: low
Maintainer: Robert Luberda <robert@debian.org>
Changed-By: Robert Luberda <robert@debian.org>
Description: 
 mailx      - A simple mail user agent
Closes: 313306
Changes: 
 mailx (1:8.1.2-0.20050715cvs-1) unstable; urgency=low
 .
   * New upstream version from OpenBSD CVS repository:
     + fixed segfault in list.c (closes: #313306).
   * Standard-Version: 3.6.2 (no changes).
Files: 
 248f2ec3d13a29ac1eedcb8eb4c2ab1f 633 mail important mailx_8.1.2-0.20050715cvs-1.dsc
 3ba08abd8bbd0a87ea5bad05cded3bc3 94664 mail important mailx_8.1.2-0.20050715cvs.orig.tar.gz
 38de40f8b082f4d592262c04275e2f30 36758 mail important mailx_8.1.2-0.20050715cvs-1.diff.gz
 166fffae0e1ce008d92492dd17a7211a 155018 mail important mailx_8.1.2-0.20050715cvs-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFC1uhbThh1cJ0wnDsRAgI9AJ94YIXGebhtaMYczzQpthe5iIq95QCfeRhT
MdqjB1Oq/ikQbwsuawfpPK8=
=oHus
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.