[Bug 198687] New: Accented characters in IMAP user flags cause an infinite loop.

[alain at topaze.homeip.net]

https://bugs.kde.org/show_bug.cgi?id=198687

           Summary: Accented characters in IMAP user flags cause an
                    infinite loop.
           Product: kio
           Version: unspecified
          Platform: Ubuntu Packages
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: NOR
         Component: imap
        AssignedTo: kdepim-bugs at kde.org
        ReportedBy: alain at topaze.homeip.net


Version:            (using KDE 4.2.4)
Compiler:          gcc (Ubuntu 4.3.3-5ubuntu4) 4.3.3 
OS:                Linux
Installed from:    Ubuntu Packages

kio_imap4 enters an infinite loop in imapParser::parseLiteral if the fetched
flags for a message contain accented characters. My IMAP server is Zimbra
5.0.14. The problem started when I marked a message with a tag named
"Répondre". I don't know what the imap rfc says about accented chars in flags,
but an infinite loop is definitely not an appropriate behaviour...

gdb on the kio_imap4 process shows:

(gdb) where
#0  0xb65e18b3 in memcpy () from /lib/tls/i686/cmov/libc.so.6
#1  0xb7d91a88 in QByteArray::realloc (this=0xbf8a7584, alloc=0) at
/usr/include/bits/string3.h:52
#2  0xb5e0472f in imapParser::parseOneWord (inWords=@0xbf8a77ec,
stopAtBracket=false) at /usr/include/qt4/QtCore/qbytearray.h:410
#3  0xb5e05c19 in imapParser::parseLiteral (this=0x9193028,
inWords=@0xbf8a77ec, relay=false, stopAtBracket=40)
    at /build/buildd/kdepimlibs-4.2.4/kioslave/imap4/imapparser.cpp:1929
#4  0xb5e05f9e in imapParser::parseSentence (this=0x9193028,
inWords=@0xbf8a77ec)
    at /build/buildd/kdepimlibs-4.2.4/kioslave/imap4/imapparser.cpp:1642
#5  0xb5e0ada6 in imapParser::parseFetch (this=0x9193028, inWords=@0xbf8a77ec)
    at /build/buildd/kdepimlibs-4.2.4/kioslave/imap4/imapparser.cpp:1460
#6  0xb5e0eb22 in imapParser::parseUntagged (this=0x9193028,
result=@0xbf8a77ec)
    at /build/buildd/kdepimlibs-4.2.4/kioslave/imap4/imapparser.cpp:496
#7  0xb5e0efd2 in imapParser::parseLoop (this=0x9193028) at
/build/buildd/kdepimlibs-4.2.4/kioslave/imap4/imapparser.cpp:1752
#8  0xb5dfc3c4 in IMAP4Protocol::listDir (this=0x9193010, _url=@0xbf8a7bec) at
/build/buildd/kdepimlibs-4.2.4/kioslave/imap4/imap4.cpp:607
#9  0xb78f3574 in KIO::SlaveBase::dispatch (this=0x9193010, command=71,
data=@0xbf8a7cc0)
    at /build/buildd/kde4libs-4.2.4/kio/kio/slavebase.cpp:1081
#10 0xb5df8548 in IMAP4Protocol::dispatch (this=0x9193010, command=71,
data=@0xbf8a7cc0)
    at /build/buildd/kdepimlibs-4.2.4/kioslave/imap4/imap4.cpp:1835
#11 0xb78f1cfc in KIO::SlaveBase::dispatchLoop (this=0x9193010) at
/build/buildd/kde4libs-4.2.4/kio/kio/slavebase.cpp:282
#12 0xb5de594d in kdemain (argc=4, argv=0x917bb70) at
/build/buildd/kdepimlibs-4.2.4/kioslave/imap4/imap4.cpp:136
#13 0x0804dd11 in launch (argc=4, _name=0x9166bc4 "kio_imap4", args=0x9166c3d
"", cwd=0x0, envc=0, envs=0x9166c42 "", reset_env=false,
    tty=0x0, avoid_loops=false, startup_id_str=0x8050c93 "0") at
/build/buildd/kde4libs-4.2.4/kinit/kinit.cpp:689
#14 0x0804e47d in handle_launcher_request (sock=7) at
/build/buildd/kde4libs-4.2.4/kinit/kinit.cpp:1270
#15 0x0804e9ca in handle_requests (waitForPid=0) at
/build/buildd/kde4libs-4.2.4/kinit/kinit.cpp:1463
#16 0x0804f604 in main (argc=2, argv=0xbf8a83f4, envp=0xbf8a8400) at
/build/buildd/kde4libs-4.2.4/kinit/kinit.cpp:1951
(gdb) break imapParser::parseLiteral
Breakpoint 1 at 0xb5e059bd: file
/build/buildd/kdepimlibs-4.2.4/kioslave/imap4/imapparser.h, line 56. (2
locations)
(gdb) cont
Continuing.
[Switching to Thread 0xb5f88a10 (LWP 1111)]

Breakpoint 1, imapParser::parseLiteral (this=0x9193028, inWords=@0xbf8a77ec,
relay=false, stopAtBracket=false)
    at /build/buildd/kdepimlibs-4.2.4/kioslave/imap4/imapparser.h:56
56      /build/buildd/kdepimlibs-4.2.4/kioslave/imap4/imapparser.h: No such
file or directory.
        in /build/buildd/kdepimlibs-4.2.4/kioslave/imap4/imapparser.h
(gdb) p inWords.data.d
$1 = (QByteArray::Data *) 0x923f0c0
(gdb) x/40s 0x923f0c0
0x923f0c0:       "\001"
0x923f0c2:       ""
0x923f0c3:       ""
0x923f0c4:       "1"
0x923f0c6:       ""
0x923f0c7:       ""
0x923f0c8:       "/"
0x923f0ca:       ""
0x923f0cb:       ""
0x923f0cc:       "��#\t* 953 FETCH (UID 15518 FLAGS (\\Seen Répondre))"
0x923f100:       "\n"

(see the FETCH line).

This is reproducible.

-- 
Configure bugmail: https://bugs.kde.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.