#1087653 libgmime-3.0-0: rfc2047 chunked header decoding may fail

Package:
libgmime-3.0-0
Source:
libgmime-3.0-0
Description:
MIME message parser and creator library
Submitter:
Albrecht Dreß
Date:
2024-11-17 12:57:02 UTC
Severity:
normal
#1087653#5
Date:
2024-11-16 18:02:26 UTC
From:
To:
Dear Maintainer,

in libgmime v. 3.2.13+dfsg-2, the funktion g_mime_utils_header_decode_text()
sometimes fails to decode chunked header lines, like “=?utf-8?B?VGhpcw==?=
=?utf-8?B?IGlzIGEgdGVzdCE=?=”, which returns the value “This” instead of the
correct “This is a test!”.  Apparently the issue has been fixed at least in
GMime v. 3.2.15.

To reproduce, compile the following trivial code
<snip>
#include <gmime/gmime.h>

int
main(int argc, char **argv)
{
        int n;

        g_mime_init();
        for (n = 1; n < argc; n++) {
                gchar *result;

                g_printf("arg: '%s'\n", argv[n]);
                result = g_mime_utils_header_decode_text(NULL, argv[n]);
                g_printf("res: '%s'\n", result);
                g_free(result);
        }
        return 0;
}
</snip>

and call it with the example value above:
<snip>
$ ./decode-test '=?utf-8?B?VGhpcw==?= =?utf-8?B?IGlzIGEgdGVzdCE=?='
arg: '=?utf-8?B?VGhpcw==?= =?utf-8?B?IGlzIGEgdGVzdCE=?='
res: 'This'
$ LD_PRELOAD=~/Neues/gmime-3.2.15/gmime/.libs/libgmime-3.0.so.0.214.1 ./decode-
test '=?utf-8?B?VGhpcw==?= =?utf-8?B?IGlzIGEgdGVzdCE=?='
arg: '=?utf-8?B?VGhpcw==?= =?utf-8?B?IGlzIGEgdGVzdCE=?='
res: 'This is a test!'
</snip>

As the issue may lead to incorrect information being displayed to the user,
IMHO it is a serious bug.

Thanks, Albrecht.

#1087653#10
Date:
2024-11-17 12:54:24 UTC
From:
To:
I noticed that GMime 3.2.14 unfortunately introduced an incompatible API change

(<https://github.com/jstedfast/gmime/releases/tag/3.2.14>, <https://github.com/jstedfast/gmime/blob/141ce4a1925e9f6a4d95ac3d9cc9de5995913a02/gmime/gmime-parser-options.h#L131>) which will require *all* applications using this function to be changed.  IOW, updating GMime to ≥ 3.2.14 is no solution.  See also <https://github.com/jstedfast/gmime/issues/172>.