Please note: I have submitted this bug once before, however I did not receive any confirmation from the Debian BTS.

Dear Maintainer,

when investigating segfaults logged by our web applications we have discovered php-imap might be to blame. The extension appears to be largely unmaintained upstream and several projects migrate their code bases over to pure PHP implementations because of this. That being said as far as I'm aware the IMAP extension is still widely used.

We're filing this bug as important because segfaults in a web application raise security concerns and this bug might have implications for the package's life on the upcoming Debian Bullseye.

Via CLI the segfault and errors look like this:

PHP Fatal error:  Uncaught ErrorException: Notice: Unknown: Unexpected characters at end of address: < (errflg=3) in Unknown:0
Stack trace:
#0 [internal function]: Symfony\Component\ErrorHandler\ErrorHandler->handleError(8, 'Unknown: Unexpe...', 'Unknown', 0, NULL)
#1 {main}
  thrown in Unknown on line 0
Fatal error: Uncaught ErrorException: Notice: Unknown: Unexpected characters at end of address: < (errflg=3) in Unknown:0
Stack trace:
#0 [internal function]: Symfony\Component\ErrorHandler\ErrorHandler->handleError(8, 'Unknown: Unexpe...', 'Unknown', 0, NULL)
#1 {main}
  thrown in Unknown on line 0
Segmentation fault (core dumped)

Please note the fatal error at the beginning which we deliberately caused in this case. Our observations suggest that at least so far the error only occurs when dealing with invalid user input.

We were able to create a "simple" PHP application that can trigger the segfault. This essentially is a minimal Symfony application with a couple of lines added to the console executable.
--- bin/console.bak    2021-02-25 13:23:42.354144465 +0100
+++ bin/console    2021-02-25 13:23:52.295159143 +0100
@@ -38,7 +38,11 @@
     }
 }

-
+$addr = "invalid <";
+$res = imap_rfc822_parse_adrlist($addr, "");
+//$errors = imap_errors();
+print_r($res);
+//print_r($errors)

 $kernel = new Kernel($_SERVER['APP_ENV'], (bool) $_SERVER['APP_DEBUG']);
 $application = new Application($kernel);

You can create the base Symfony application using `composer create-project symfony/skeleton dummy` or simply use the version I've attached that is already modified to trigger the issue.

To reproduce the segfault run: `bin/console about`

As you might have noticed diff above shows a couple of commented out lines. These are used to demonstrate the workaround. Calling `imap_errors()` appears to avoid the segfaults in our case. We're not sure however if this constitutes a true workaround from a security point of view. In at least one case we've also seen php-imap attempt to allocate unreasonably large amounts of memory for unknown reasons causing the process to die.


Best regards,
Kim-Alexander Brodowski
IServ GmbH

Dear Maintainer,
I tried to have a look at this segfault.

As far as I can see the issue here is a memory access after the
php heap, where this memory was allocated from, got unmapped.

Below are the backtraces for allocation [1], unmapping [2]
and the segfault [3].
Some more details in attached file.

Kind regards,
Bernhard


[1]
     Breakpoint 69, 0x00005636fef8fa40 in timelib_strtotime (s=0x5636ff1ae641 "now", len=len@entry=3, errors=errors@entry=0x7fffd2243b98, tzdb=0x5636ffcb14c0, tz_get_wrapper=tz_get_wrapper@entry=0x5636fef86af0 <php_date_parse_tzfile_wrapper>) at ./ext/date/lib/parse_date.c:22046
     22046           in.errors = timelib_malloc(sizeof(timelib_error_container));
     1: x/i $pc
     => 0x5636fef8fa40 <timelib_strtotime+80>:       mov    %rax,0x60(%rsp)
     (rr) bt
     #0  0x00005636fef8fa40 in timelib_strtotime (s=0x5636ff1ae641 "now", len=len@entry=3, errors=errors@entry=0x7fffd2243b98, tzdb=0x5636ffcb14c0, tz_get_wrapper=tz_get_wrapper@entry=0x5636fef86af0 <php_date_parse_tzfile_wrapper>) at ./ext/date/lib/parse_date.c:22046
     #1  0x00005636fef8c18c in php_date_initialize (dateobj=0x7f3a880d1a10, time_str=0x0, time_str_len=<optimized out>, format=0x0, timezone_object=0x0, ctor=1) at ./ext/date/php_date.c:2686
     #2  0x00005636fef8c9e5 in zim_DateTime___construct (execute_data=0x7f3a8921f0c0, return_value=<optimized out>) at ./ext/date/php_date.h:143
     #3  0x00005636ff1a0b4b in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at ./Zend/zend_vm_execute.h:984
     #4  execute_ex (ex=0x7f3a89200040) at ./Zend/zend_vm_execute.h:55523
     #5  0x00005636ff1a25e7 in zend_execute (op_array=op_array@entry=0x7f3a880c0600, return_value=0x0, return_value@entry=0x7f3a8921e9c0) at ./Zend/zend_vm_execute.h:60935
     #6  0x00005636ff11b233 in zend_execute_scripts (type=type@entry=8, retval=0x7f3a8921e9c0, retval@entry=0x0, file_count=file_count@entry=3) at ./Zend/zend.c:1568
     #7  0x00005636ff0bb788 in php_execute_script (primary_file=<optimized out>) at ./main/main.c:2637
     #8  0x00005636ff1a4b9e in do_cli (argc=3, argv=0x5636ffb0ca30) at ./sapi/cli/php_cli.c:1000
     #9  0x00005636fef80b9b in main (argc=3, argv=0x5636ffb0ca30) at ./sapi/cli/php_cli.c:1396
     (rr) when
     Current event: 4495
     (rr) x/4xb 0x7f3a88055ca8
     0x7f3a88055ca8: 0xb0    0xa1    0x0e    0x88


[2]
     Breakpoint 70, munmap () at ../sysdeps/unix/syscall-template.S:78
     78      ../sysdeps/unix/syscall-template.S: Datei oder Verzeichnis nicht gefunden.
     1: x/i $pc
     => 0x7f3a8b7e31d0 <munmap>:     mov    $0xb,%eax
     (rr) bt
     #0  munmap () at ../sysdeps/unix/syscall-template.S:78
     #1  0x00005636ff0f26f7 in zend_mm_munmap (size=2097152, addr=<optimized out>) at ./Zend/zend_alloc.c:777
     #2  zend_mm_chunk_free (addr=<optimized out>, size=size@entry=2097152, heap=<optimized out>) at ./Zend/zend_alloc.c:777
     #3  0x00005636ff0f2b3a in zend_mm_shutdown (heap=0x7f3a89200040, full=0, silent=<optimized out>) at ./Zend/zend_alloc.c:2301
     #4  0x00005636ff0ba357 in php_request_shutdown (dummy=<optimized out>) at ./main/main.c:1951
     #5  0x00005636ff1a3fda in do_cli (argc=3, argv=0x5636ffb0ca30) at ./sapi/cli/php_cli.c:1167
     #6  0x00005636fef80b9b in main (argc=3, argv=0x5636ffb0ca30) at ./sapi/cli/php_cli.c:1396
     (rr) when
     Current event: 4620
     (rr) x/4xb 0x7f3a88055ca8
     0x7f3a88055ca8: 0x00    0x00    0x00    0x00
     (rr) finish
     Run till exit from #0  munmap () at ../sysdeps/unix/syscall-template.S:78
     0x00005636ff0f26f7 in zend_mm_munmap (size=2097152, addr=<optimized out>) at ./Zend/zend_alloc.c:777
     777             zend_mm_munmap(addr, size);
     1: x/i $pc
     => 0x5636ff0f26f7 <zend_mm_chunk_free+23>:      test   %eax,%eax
     (rr) x/4xb 0x7f3a88055ca8
     0x7f3a88055ca8: Cannot access memory at address 0x7f3a88055ca8


[3]
     PHP Fatal error:  Uncaught ErrorException: Notice: Unknown: Unexpected characters at end of address: < (errflg=3) in Unknown:0
     Stack trace:
     #0 [internal function]: Symfony\Component\ErrorHandler\ErrorHandler->handleError(8, 'Unknown: Unexpe...', 'Unknown', 0, NULL)
     #1 {main}
     thrown in Unknown on line 0

     Program received signal SIGSEGV, Segmentation fault.
     0x00005636fefac749 in timelib_error_container_dtor (errors=0x7f3a88055ca8) at ./ext/date/lib/timelib.c:156
     156             for (i = 0; i < errors->warning_count; i++) {
     1: x/i $pc
     => 0x5636fefac749 <timelib_error_container_dtor+9>:     mov    0x14(%rdi),%edi
     2: /x $rax = 0x0
     3: /x $rsp = 0x7fffd2247350
     (rr) bt
     #0  0x00005636fefac749 in timelib_error_container_dtor (errors=0x7f3a88055ca8) at ./ext/date/lib/timelib.c:156
     #1  0x00005636fef82e9c in zm_shutdown_date (type=<optimized out>, module_number=<optimized out>) at ./ext/date/php_date.c:945
     #2  0x00005636ff120397 in module_destructor (module=module@entry=0x5636ffb3ace0) at ./Zend/zend_API.c:2575
     #3  0x00005636ff119e6c in module_destructor_zval (zv=<optimized out>) at ./Zend/zend.c:745
     #4  0x00005636ff12ada3 in _zend_hash_del_el_ex (prev=<optimized out>, p=<optimized out>, idx=1, ht=<optimized out>) at ./Zend/zend_hash.c:1182
     #5  _zend_hash_del_el (p=0x5636ffb900f0, idx=1, ht=0x5636ff31b260 <module_registry>) at ./Zend/zend_hash.c:1205
     #6  zend_hash_graceful_reverse_destroy (ht=ht@entry=0x5636ff31b260 <module_registry>) at ./Zend/zend_hash.c:1659
     #7  0x00005636ff11ec8c in zend_destroy_modules () at ./Zend/zend_API.c:2013
     #8  0x00005636ff11ac43 in zend_shutdown () at ./Zend/zend.c:976
     #9  0x00005636ff0bb3aa in php_module_shutdown () at ./main/main.c:2496
     #10 php_module_shutdown () at ./main/main.c:2470
     #11 0x00005636fef80bf7 in main (argc=3, argv=0x5636ffb0ca30) at ./sapi/cli/php_cli.c:1411
     (rr) when
     Current event: 4714
     (rr) x/4xb 0x7f3a88055ca8
     0x7f3a88055ca8: Cannot access memory at address 0x7f3a88055ca8

Dear Team,

Hope you are doing well.

Can you please share price, lead time and requirements for the following
product models based on the attached document.

We would appreciate receiving your quotation at your earliest
convenience.

Best regards,

Amelia Thompson
Technical Account Manager

IMCD Canada Limited 99 Summerlea Road * Brampton, ON L6T 4V2 * Canada

P +1-365-866-1905

E Ameliathompson@imcdca.com   W www.imcdgroup.com [1]

Links:
------
[1] http://www.imcdgroup.com/