crash due to null pointer access when imap server sends early preauth
We observed a crash in balsa. This can be reproduced by having a server that simply sends a PREAUTH command, e.g. by doing this on the command line with netcat and letting balsa connect to localhost via imap:
echo -n "* PREAUTH\r\n" | nc -l -p 143
I'm pasting an error from Address Sanitizer below, it indicates the error is in libbalsa/imap/imap-handle.c:827.
That code looks like this:
handle->can_fetch_body =
(strncmp(handle->last_msg, "Microsoft Exchange", 18) != 0);
It seems this crashes when handle->last_msg is not set (i.e. NULL), which causes strncmp accessing a null pointer. preventing this by first checking that handle->last_msg is not NULL prevents the crash, however there's probably an underlying deeper issue within the state management of the imap implementation.
ASAN error:
==3171==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f312ac84c30 bp 0x7ffce7d9e2d0 sp 0x7ffce7d9da30 T0)
==3171==The signal is caused by a READ memory access.
==3171==Hint: address points to the zero page.
#0 0x7f312ac84c2f (/usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/libasan.so.5+0xd5c2f)
#1 0x55f918e2da93 in imap_mbox_connect /var/tmp/portage/mail-client/balsa-2.5.6-r1/work/balsa-2.5.6/libbalsa/imap/imap-handle.c:827
#2 0x55f918e2e052 in imap_mbox_handle_connect /var/tmp/portage/mail-client/balsa-2.5.6-r1/work/balsa-2.5.6/libbalsa/imap/imap-handle.c:597
#3 0x55f918d999b7 in libbalsa_imap_server_get_handle /var/tmp/portage/mail-client/balsa-2.5.6-r1/work/balsa-2.5.6/libbalsa/imap-server.c:665
#4 0x55f918d9001c in libbalsa_scanner_imap_dir /var/tmp/portage/mail-client/balsa-2.5.6-r1/work/balsa-2.5.6/libbalsa/folder-scanners.c:413
#5 0x55f918d0c7f0 in imap_dir_cb /var/tmp/portage/mail-client/balsa-2.5.6-r1/work/balsa-2.5.6/src/mailbox-node.c:502
#6 0x7f3129347d7c in g_closure_invoke (/usr/lib64/libgobject-2.0.so.0+0x13d7c)
#7 0x7f312935aa36 (/usr/lib64/libgobject-2.0.so.0+0x26a36)
#8 0x7f31293637cc in g_signal_emit_valist (/usr/lib64/libgobject-2.0.so.0+0x2f7cc)
#9 0x7f3129363e36 in g_signal_emit (/usr/lib64/libgobject-2.0.so.0+0x2fe36)
#10 0x55f918d1ec60 in scan_mailboxes_idle_cb /var/tmp/portage/mail-client/balsa-2.5.6-r1/work/balsa-2.5.6/src/main.c:254
#11 0x7f312926129f in g_main_context_dispatch (/usr/lib64/libglib-2.0.so.0+0x4e29f)
#12 0x7f3129261667 (/usr/lib64/libglib-2.0.so.0+0x4e667)
#13 0x7f3129261992 in g_main_loop_run (/usr/lib64/libglib-2.0.so.0+0x4e992)
#14 0x7f3129a2d95c in gtk_main (/usr/lib64/libgtk-3.so.0+0x23895c)
#15 0x55f918d1fa6c in real_main /var/tmp/portage/mail-client/balsa-2.5.6-r1/work/balsa-2.5.6/src/main.c:566
#16 0x55f918d1fa6c in command_line_cb /var/tmp/portage/mail-client/balsa-2.5.6-r1/work/balsa-2.5.6/src/main.c:749
#17 0x7f3127643bac (/usr/lib64/libffi.so.7+0x6bac)
#18 0x7f3127643138 (/usr/lib64/libffi.so.7+0x6138)
#19 0x7f3129348599 in g_cclosure_marshal_generic (/usr/lib64/libgobject-2.0.so.0+0x14599)
#20 0x7f3129347d7c in g_closure_invoke (/usr/lib64/libgobject-2.0.so.0+0x13d7c)
#21 0x7f312935aa36 (/usr/lib64/libgobject-2.0.so.0+0x26a36)
#22 0x7f3129362e49 in g_signal_emit_valist (/usr/lib64/libgobject-2.0.so.0+0x2ee49)
#23 0x7f3129363e36 in g_signal_emit (/usr/lib64/libgobject-2.0.so.0+0x2fe36)
#24 0x7f312945ab02 (/usr/lib64/libgio-2.0.so.0+0xc9b02)
#25 0x7f312945cca8 (/usr/lib64/libgio-2.0.so.0+0xcbca8)
#26 0x7f312945ce69 in g_application_run (/usr/lib64/libgio-2.0.so.0+0xcbe69)
#27 0x55f918cb4c60 in main /var/tmp/portage/mail-client/balsa-2.5.6-r1/work/balsa-2.5.6/src/main.c:773
#28 0x7f312901ce8a in __libc_start_main ../csu/libc-start.c:308
#29 0x55f918cb5e79 in _start (/usr/bin/balsa+0xb9e79)