Skip to content
GitLab
Projects Groups Topics Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Register
  • Sign in
  • E evolution-data-server
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
  • Issues 42
    • Issues 42
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 0
    • Merge requests 0
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Container Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • GNOMEGNOME
  • evolution-data-server
  • Issues
  • #189
Closed
Open
Issue created Feb 09, 2020 by Hanno Böck@hanno

Crash on malformed server response with minimal capabilities

evolution can crash with a null pointer access if it gets some malformed responses from the server. This requires a configuration with STARTTLS.

Here's a minimized example of a crashing imap session:

* OK x
A00000 CAPABILITY
A00000 OK [x]
A00001 STARTTLS
A00001 OK x

First, third and fifth line come from the server, this can be simulated with netcat (nc -l -p 143, setting imap server to localhost), only thing that needs to happen dynamically is that the A00000-prefix isn't static, this can be something else from the client.

This leads to a crash in imapx_free_capability, caused by this code in imapx_connect_to_server:

			/* See if we got new capabilities
			 * in the STARTTLS response. */
			imapx_free_capability (is->priv->cinfo);

I believe what happens here is that cinfo isn't filled in some situations and the code expects it to be filled and wants to free it after initializing a STARTTLS process.

Here's a crash report from asan:

==6994==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7fa0a7b14f38 bp 0x000000000000 sp 0x7fa0a785f400 T5)
==6994==The signal is caused by a READ memory access.
==6994==Hint: address points to the zero page.
    #0 0x7fa0a7b14f37 in imapx_free_capability /var/tmp/portage/gnome-extra/evolution-data-server-3.32.5/work/evolution-data-server-3.32.5/src/camel/providers/imapx/camel-imapx-utils.c:605
    #1 0x7fa0a7aeebc2 in imapx_connect_to_server /var/tmp/portage/gnome-extra/evolution-data-server-3.32.5/work/evolution-data-server-3.32.5/src/camel/providers/imapx/camel-imapx-server.c:3052
    #2 0x7fa0a7afdafa in imapx_reconnect /var/tmp/portage/gnome-extra/evolution-data-server-3.32.5/work/evolution-data-server-3.32.5/src/camel/providers/imapx/camel-imapx-server.c:3355
    #3 0x7fa0a7afdafa in camel_imapx_server_connect_sync /var/tmp/portage/gnome-extra/evolution-data-server-3.32.5/work/evolution-data-server-3.32.5/src/camel/providers/imapx/camel-imapx-server.c:4227
    #4 0x7fa0a7abac5f in imapx_create_new_connection_unlocked /var/tmp/portage/gnome-extra/evolution-data-server-3.32.5/work/evolution-data-server-3.32.5/src/camel/providers/imapx/camel-imapx-conn-manager.c:789
    #5 0x7fa0a7abac5f in camel_imapx_conn_manager_ref_connection /var/tmp/portage/gnome-extra/evolution-data-server-3.32.5/work/evolution-data-server-3.32.5/src/camel/providers/imapx/camel-imapx-conn-manager.c:914
    #6 0x7fa0a7abbafa in camel_imapx_conn_manager_connect_sync /var/tmp/portage/gnome-extra/evolution-data-server-3.32.5/work/evolution-data-server-3.32.5/src/camel/providers/imapx/camel-imapx-conn-manager.c:1040
    #7 0x7fa0a7b0dd10 in imapx_connect_sync /var/tmp/portage/gnome-extra/evolution-data-server-3.32.5/work/evolution-data-server-3.32.5/src/camel/providers/imapx/camel-imapx-store.c:984
    #8 0x7fa0b98d8cac in service_shared_connect_thread /var/tmp/portage/gnome-extra/evolution-data-server-3.32.5/work/evolution-data-server-3.32.5/src/camel/camel-service.c:532
    #9 0x7fa0b8057171  (/usr/lib64/libgio-2.0.so.0+0xa2171)
    #10 0x7fa0b7eae713  (/usr/lib64/libglib-2.0.so.0+0x77713)
    #11 0x7fa0b7eadd2c  (/usr/lib64/libglib-2.0.so.0+0x76d2c)
    #12 0x7fa0b2e5d2d6 in start_thread /var/tmp/portage/sys-libs/glibc-2.30-r3/work/glibc-2.30/nptl/pthread_create.c:479
    #13 0x7fa0b2d8ba5e in __clone (/lib64/libc.so.6+0x106a5e)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /var/tmp/portage/gnome-extra/evolution-data-server-3.32.5/work/evolution-data-server-3.32.5/src/camel/providers/imapx/camel-imapx-utils.c:605 in imapx_free_capability
Thread T5 (pool-evolution) created by T0 here:
    #0 0x7fa0b9b3e211 in pthread_create (/usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/libasan.so.5+0x3a211)
    #1 0x7fa0b7ecfd32  (/usr/lib64/libglib-2.0.so.0+0x98d32)
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking