Bug#771125: mutt: buffer overflow

[Jakub Wilk]

Package: mutt
Version: 1.5.23-1.1
Tags: security




Backtrace:

#0  __memcpy_ia32 () at ../sysdeps/i386/i686/multiarch/../memcpy.S:90
#1  0x080b74fa in memcpy (__len=4294967295, __src=0x8a45b65, __dest=0x8a45b65) 
at /usr/include/i386-linux-gnu/bits/string3.h:51
#2  mutt_substrdup (begin=0x8a45b65 "I\n", end=0x8a45b64 "\rI\n") at 
../lib.c:824
#3  0x080ac13f in write_one_header (fp=0x8a45b65, pfxw=0, max=2147483647, wraplen=180, pfx=0x0, 
start=0x8a45b5e "From:\n\rI\n", end=0x8a45b64 "\rI\n", flags=262164) at 
../sendlib.c:1818
#4  0x080aefaa in mutt_write_one_header (fp=0x8a45900, tag=0x8a45b5e "From:\n\rI\n", 
value=0x8a45b63 "\n\rI\n", pfx=0x0, wraplen=180, flags=262164) at ../sendlib.c:1894
#5  0x0806248a in mutt_copy_hdr (in=0x0, out=0x8a45900, off_start=622720505018843140, 
off_end=<optimized out>, flags=262164, prefix=0x0) at ../copy.c:290
#6  0x08062bad in mutt_copy_header (in=0x7fffffff, h=0x8a44668, out=0x8a45900, 
flags=262164, prefix=0x0) at ../copy.c:351
#7  0x08062fbf in _mutt_copy_message (fpout=0x8a45900, fpin=0x8a3b3e8, 
hdr=0x8a44668, body=0x8a44750, flags=76, chflags=262164) at ../copy.c:571
#8  0x0806363b in mutt_copy_message (fpout=0x8a45900, src=0x8a3b910, 
hdr=0x8a44668, flags=76, chflags=262164) at ../copy.c:688
#9  0x0805c3b6 in mutt_display_message (cur=0x8a44668) at ../commands.c:148
#10 0x08068e9a in mutt_index_menu () at ../curs_main.c:1227
#11 0x0804e696 in main (argc=<optimized out>, argv=0xffc99284) at ../main.c:1056


This bug was brought to you by American fuzzy lop:
http://lcamtuf.coredump.cx/afl/

-- System Information:
Debian Release: jessie/sid
 APT prefers unstable
 APT policy: (990, 'unstable'), (500, 'experimental')
Architecture: i386 (x86_64)
Foreign Architectures: amd64

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages mutt depends on:
ii  libassuan0         2.1.2-2
ii  libc6              2.19-13
ii  libcomerr2         1.42.12-1
ii  libgnutls-deb0-28  3.3.8-5
ii  libgpg-error0      1.17-2
ii  libgpgme11         1.5.1-6
ii  libgssapi-krb5-2   1.12.1+dfsg-15
ii  libidn11           1.29-1
ii  libk5crypto3       1.12.1+dfsg-15
ii  libkrb5-3          1.12.1+dfsg-15
ii  libncursesw5       5.9+20140913-1
ii  libsasl2-2         2.1.26.dfsg1-12
ii  libtinfo5          5.9+20140913-1
ii  libtokyocabinet9   1.4.48-3

--
Jakub Wilk

mutt segfaults when trying to show the attached message. (You might need to disable header weeding to trigger the crash.)

crasher.mbox.gz
Description: application/gzip