When attempting to view an email from British Airways, Horde/IMP would cause a reliably reproducable segmentation fault in the zend hash implementation.

I have worked the minimum-tripping example to:

---CUT
From user@otherdomain.com Mon Mar 10 17:23:48 2003
From: <user@otherdomain.com>
To: <user@domain.example>
CC: <>
Reply-To: <user@domain.com>
Subject: Crashy email

This email crashes IMP
---CUT

The guys at horde.org say it's a PHP problem and that I should ask you guys to solve it.

If you could, I'd be very very grateful -- I have several customers whose email is very affected by this bug.

It appears that the bug is provoked by the adding of the odd CC header into the hash table of headers maintained by the IMAP code.

Here is a GDB backtrace of it happening in 4.3.1 release:

Program received signal SIGSEGV, Segmentation fault.
0x402d2998 in malloc () from /lib/libc.so.6
(gdb) bt
#0  0x402d2998 in malloc () from /lib/libc.so.6
#1  0x402d2074 in malloc () from /lib/libc.so.6
#2  0x0811d53c in _emalloc (size=53)
    at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_alloc.c:154
#3  0x0812d126 in zend_hash_add_or_update (ht=0x833a004, 
    arKey=0x8159ee6 "mon_thousands_sep", nKeyLength=18, pData=0xbfff2118, 
    nDataSize=4, pDest=0x0, flag=1)
    at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_hash.c:262
#4  0x0812b61c in add_assoc_string_ex (arg=0x828d864, 
    key=0x8159ee6 "mon_thousands_sep", key_len=18, str=0x404a30c9 ",", 
    duplicate=1) at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_API.c:673
#5  0x080d953d in zif_localeconv (ht=0, return_value=0x828d864, this_ptr=0x0, 
    return_value_used=1)
    at /home/dsilvers/new-webmail/php-4.3.1/ext/standard/string.c:3766
#6  0x0813982a in execute (op_array=0x836253c)
    at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_execute.c:1598
#7  0x08139984 in execute (op_array=0x83639a4)
    at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_execute.c:1640
#8  0x08139984 in execute (op_array=0x8362a2c)
    at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_execute.c:1640
#9  0x08139984 in execute (op_array=0x824dcbc)
    at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend_execute.c:1640
#10 0x0812a598 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /home/dsilvers/new-webmail/php-4.3.1/Zend/zend.c:864
#11 0x081087ef in php_execute_script (primary_file=0xbffffe48)
    at /home/dsilvers/new-webmail/php-4.3.1/main/main.c:1573
#12 0x08144a43 in main (argc=1, argv=0xbffffec4)
    at /home/dsilvers/new-webmail/php-4.3.1/sapi/cgi/cgi_main.c:1424
(gdb) quit

Here's my configure line:

./configure  --enable-fastcgi --with-pgsql --disable-ipv6 --with-imap --with-gettext --with-xml --with-mcrypt --prefix=/usr/local/webmail/php --with-imap-ssl  --with-zlib --disable-safe-mode

Here's info about the system:

Linux salmon 2.4.18 #1 Thu Mar 14 19:06:39 GMT 2002 i686 unknown
 
It's a duron 600 based system with plenty of free ram and swap.

It is running Debian GNU/Linux 3.0r1 (Woody) with security patches

PHP is compiled up from source.

If there's any other information you need, just yell.

D.