Bug#819196: mutt segfaults on scoring with ~X

[Antonio Radici]

On Thu, Mar 24, 2016 at 07:06:47PM +0100, Francesco Ariis wrote:
> Package: mutt
> Version: 1.5.23-3
> Severity: normal
> 
> Dear Maintainer,
> 
> open your .muttrc, paste this line
> 
> score "~X >1" -60
> 
> save, load mutt, enter any folder, mutt crashes with
> 
> Reading /home/user/mailfolder/folder... 0/438 (0%)Segmentation fault
> 
> Note that this pattern only crashes if used in a scoring rule (i.e.
> you can use ~X in a 'limit' pattern).
> 

Ciao Francesco,
the upstream bug has been resolved, it seems that ~X cannot be used in
message scoring, you can find more info in the forwarded bug.


I've added their change to our git repo and this will be included in 1.7.0-2

Bug#819196: mutt segfaults on scoring with ~X

[Antonio Radici]

Control: tag -1 +pending

On Thu, Mar 24, 2016 at 07:06:47PM +0100, Francesco Ariis wrote:
> Package: mutt
> Version: 1.5.23-3
> Severity: normal
> 
> Dear Maintainer,
> 
> open your .muttrc, paste this line
> 
> score "~X >1" -60
> 
> save, load mutt, enter any folder, mutt crashes with
> 
> Reading /home/user/mailfolder/folder... 0/438 (0%)Segmentation fault
> 
> Note that this pattern only crashes if used in a scoring rule (i.e.
> you can use ~X in a 'limit' pattern).
> 

backtrace FTR:

mx_open_message (ctx=ctx@entry=0x0, msgno=0) at ../../mx.c:1440
1440  if (!ctx->mx_ops->open_msg)
(gdb) bt
#0  mx_open_message (ctx=ctx@entry=0x0, msgno=0) at ../../mx.c:1440
#1  0x555c27eb in mutt_parse_mime_message (ctx=0x0, cur=0x55f08b40) 
at ../../parse.c:965
#2  0x555c29b5 in mutt_count_body_parts (ctx=, 
hdr=0x55f08b40) at ../../parse.c:1740
#3  0x555c4d6b in mutt_pattern_exec (pat=0x559f9e20, 
flags=MUTT_MATCH_FULL_ADDRESS, ctx=0x0, h=0x55f08b40) at 
../../pattern.c:1290
#4  0x555d3b33 in mutt_score_message (ctx=ctx@entry=0x559d2d60, 
hdr=hdr@entry=0x55f08b40, upd_ctx=upd_ctx@entry=0) at ../../score.c:136
#5  0x555b7735 in mx_update_context (ctx=ctx@entry=0x559d2d60, 
new_messages=) at ../../mx.c:1572
#6  0x5562cfc5 in imap_read_headers (idata=0x559df780, 
msgbegin=5220, msgend=5219) at ../../../imap/message.c:379
#7  0x55629f29 in imap_open_mailbox (ctx=0x559d2d60) at 
../../../imap/imap.c:755
#8  0x555b57b0 in mx_open_mailbox (path=, flags=0, 
pctx=0x0) at ../../mx.c:679
#9  0x5556d2d9 in main (argc=1, argv=) at 
../../main.c:869
(gdb) 

Bug#819196: mutt segfaults on scoring with ~X

[Antonio Radici]

tag 819196 +confirmed upstream
found 819196 1.6.2-3
forwarded 819196 http://bugs.mutt.org/3861
thanks

On Thu, Mar 24, 2016 at 07:06:47PM +0100, Francesco Ariis wrote:
> 
> open your .muttrc, paste this line
> 
> score "~X >1" -60
> 
> save, load mutt, enter any folder, mutt crashes with
> 
> Reading /home/user/mailfolder/folder... 0/438 (0%)Segmentation fault
> 
> Note that this pattern only crashes if used in a scoring rule (i.e.
> you can use ~X in a 'limit' pattern).
> 

Reproducible all the time, I've forwarded it upstream; if I have time I will
work on a patch.

Bug#819196: mutt segfaults on scoring with ~X

[Francesco Ariis]

Package: mutt
Version: 1.5.23-3
Severity: normal

Dear Maintainer,

open your .muttrc, paste this line

score "~X >1" -60

save, load mutt, enter any folder, mutt crashes with

Reading /home/user/mailfolder/folder... 0/438 (0%)Segmentation fault

Note that this pattern only crashes if used in a scoring rule (i.e.
you can use ~X in a 'limit' pattern).


-- Package-specific info:
Mutt 1.5.23 (2014-03-12)
Copyright (C) 1996-2009 Michael R. Elkins and others.
Mutt comes with ABSOLUTELY NO WARRANTY; for details type `mutt -vv'.
Mutt is free software, and you are welcome to redistribute it
under certain conditions; type `mutt -vv' for details.

System: Linux 3.16.0-4-686-pae (i686)
ncurses: ncurses 5.9.20140913 (compiled with 5.9)
libidn: 1.29 (compiled with 1.29)
hcache backend: tokyocabinet 1.4.48

Compiler:
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/i586-linux-gnu/4.9/lto-wrapper
Target: i586-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 4.9.2-4' 
--with-bugurl=file:///usr/share/doc/gcc-4.9/README.Bugs 
--enable-languages=c,c++,java,go,d,fortran,objc,obj-c++ --prefix=/usr 
--program-suffix=-4.9 --enable-shared --enable-linker-build-id 
--libexecdir=/usr/lib --without-included-gettext --enable-threads=posix 
--with-gxx-include-dir=/usr/include/c++/4.9 --libdir=/usr/lib --enable-nls 
--with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug 
--enable-libstdcxx-time=yes --enable-gnu-unique-object --disable-vtable-verify 
--enable-plugin --with-system-zlib --disable-browser-plugin 
--enable-java-awt=gtk --enable-gtk-cairo 
--with-java-home=/usr/lib/jvm/java-1.5.0-gcj-4.9-i386/jre --enable-java-home 
--with-jvm-root-dir=/usr/lib/jvm/java-1.5.0-gcj-4.9-i386 
--with-jvm-jar-dir=/usr/lib/jvm-exports/java-1.5.0-gcj-4.9-i386 
--with-arch-directory=i386 --with-ecj-jar=/usr/share/java/eclipse-ecj.jar 
--enable-objc-gc --enable-targets=all --enable-multiarch --with-arch-32=i58
 6 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic 
--enable-checking=release --build=i586-linux-gnu --host=i586-linux-gnu 
--target=i586-linux-gnu
Thread model: posix
gcc version 4.9.2 (Debian 4.9.2-4) 

Configure options: '--prefix=/usr' '--sysconfdir=/etc' 
'--mandir=/usr/share/man' '--with-docdir=/usr/share/doc' 
'--with-mailpath=/var/mail' '--disable-dependency-tracking' 
'--enable-compressed' '--enable-debug' '--enable-fcntl' '--enable-hcache' 
'--enable-gpgme' '--enable-imap' '--enable-smtp' '--enable-pop' '--with-curses' 
'--with-gnutls' '--with-gss' '--with-idn' '--with-mixmaster' '--with-sasl' 
'--without-gdbm' '--without-bdb' '--without-qdbm' '--build' 'i586-linux-gnu' 
'build_alias=i586-linux-gnu' 'CFLAGS=-g -O2 -fstack-protector-strong -Wformat 
-Werror=format-security -Wall' 'LDFLAGS=-Wl,-z,relro' 
'CPPFLAGS=-D_FORTIFY_SOURCE=2 -I/usr/include/qdbm'

Compilation CFLAGS: -g -O2 -fstack-protector-strong -Wformat 
-Werror=format-security -Wall

Compile options:
-DOMAIN
+DEBUG
-HOMESPOOL  +USE_SETGID  +USE_DOTLOCK  +DL_STANDALONE  +USE_FCNTL  -USE_FLOCK   
+USE_POP  +USE_IMAP  +USE_SMTP  
-USE_SSL_OPENSSL  +USE_SSL_GNUTLS  +USE_SASL  +USE_GSS  +HAVE_GETADDRINFO  
+HAVE_REGCOMP  -USE_GNU_REGEX  
+HAVE_COLOR  +HAVE_START_COLOR  +HAVE_TYPEAHEAD  +HAVE_BKGDSET  
+HAVE_CURS_SET  +HAVE_META  +HAVE_RESIZETERM  
+CRYPT_BACKEND_CLASSIC_PGP  +CRYPT_BACKEND_CLASSIC_SMIME  +CRYPT_BACKEND_GPGME  
-EXACT_ADDRESS  -SUN_ATTACHMENT  
+ENABLE_NLS  -LOCALES_HACK  +COMPRESSED  +HAVE_WC_FUNCS  +HAVE_LANGINFO_CODESET 
 +HAVE_LANGINFO_YESEXPR  
+HAVE_ICONV  -ICONV_NONTRANS  +HAVE_LIBIDN  +HAVE_GETSID  +USE_HCACHE  
-ISPELL
SENDMAIL="/usr/sbin/sendmail"
MAILPATH="/var/mail"
PKGDATADIR="/usr/share/mutt"
SYSCONFDIR="/etc"
EXECSHELL="/bin/sh"
MIXMASTER="mixmaster"
To contact the developers, please mail to .
To report a bug, please visit http://bugs.mutt.org/.

misc/am-maintainer-mode.patch
features/ifdef.patch
features/xtitles.patch
features/trash-folder.patch
features/purge-message.patch
features/imap_fast_trash.patch
features/sensible_browser_position.patch
features-old/patch-1.5.4.vk.pgp_verbose_mime.patch
features/compressed-folders.patch
features/compressed-folders.debian.patch
debian-specific/Muttrc.patch
debian-specific/Md.etc_mailname_gethostbyname.patch
debian-specific/use_usr_bin_editor.patch
debian-specific/correct_docdir_in_man_page.patch
debian-specific/dont_document_not_present_features.patch
debian-specific/document_debian_defaults.patch
debian-specific/assumed_charset-compat.patch
debian-specific/467432-write_bcc.patch
debian-specific/566076-build_doc_adjustments.patch
misc/define-pgp_getkeys_command.patch
misc/gpg.rc-paths.patch
misc/smime.rc.patch
misc/fix-configure-test-operator.patch
upstream/531430-imapuser.patch
upstream/543467-thread-segfault.patch
upstream/542817-smimekeys-tmpdir.patch
upstream/548577-gpgme-1.2.patch
upstream/553321-ansi-escape-segfault.patch
upstream/547980-smime_keys-chaining.patch