|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #22048 imap_header() crashes with bad To: or From: header
Submitted: 2003-02-04 10:40 UTC Modified: 2003-02-11 16:59 UTC
From: rlineweaver at harrisonburg dot k12 dot va dot us Assigned: iliaa
Status: Closed Package: IMAP related
PHP Version: 4CVS-2003-02-04 (stable) OS: RedHat Linux 8.0 (2.4.18)
Private report: No CVE-ID:
 [2003-02-04 10:40 UTC] rlineweaver at harrisonburg dot k12 dot va dot us
This is a very similar issue to bug #19280 (, but that bug was closed and this issue still exists.

imap-2001a (from RedHat 8.0)
apache-2.0.44 (happens from CLI too, so probably irrelevant)

also occurs with php-4.3.0, apache-2.0.43

Strangely constructed To: or From: header causes a segfault, even from CLI php.  Here are sample headers to reconstruct the problem:

From  Mon Feb  3 14:08:06 2003
Return-Path: <>
Date: Mon,  3 Feb 2003 14:08:08 -0500
From: PHP Test Case <>
To: \\\\\\\\\\\\\\\\\\\ <>
Subject: test 4
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

Swapping the To: and From: headers causes the same problem.

The following script will reproduce the segfault:


    $mailbox = imap_open(
        "rob", "******", OP_READONLY);

    $header = imap_header($mailbox, 1);
    echo $header->toaddress . "\n";
    echo $header->fromaddress . "\n";



In ext/imap/php_imap.c, if I change the define:
to something larger, say 100, the segfault disappears.  Since PHP_IMAP_ADDRESS_SIZE_BUF was added to solve bug #19280 I thought this may be a related issue.

The badly constructed address above (\\\\\\\\\\\\\\\\\\\ <>) was the shortest test case I could come up with.  Note that reducing the number of backslashes makes it work, but adding the same number of alphanumeric characters back into the email address itself (between the <>) breaks it again.

An older server running PHP 4.1.2, imap-2001a, Apache 1.3.27, Horde/IMP, was not affected by the same messages.

Thanks for looking into this!  Let me know if you need additional information.  PHP ./configure line pasted below:

'./configure' '--prefix=/usr/local/php4-STABLE-200302041230' '--with-config-file-path=/etc' '--enable-force-cgi-redirect' '--disable-debug' '--enable-pic' '--disable-rpath' '--enable-inline-optimization' '--with-bz2' '--with-db4' '--with-zlib' '--with-gd' '--with-png-dir=/usr' '--with-freetype-dir=/usr' '--enable-gd-native-ttf' '--with-ttf' '--with-gdbm' '--with-gettext' '--with-ncurses' '--with-gmp' '--with-iconv' '--with-jpeg-dir=/usr' '--with-png' '--with-pspell' '--with-regex=system' '--with-xml' '--with-expat-dir=/usr' '--enable-bcmath' '--enable-exif' '--enable-ftp' '--enable-magic-quotes' '--enable-safe-mode=no' '--enable-sockets' '--enable-sysvsem' '--enable-sysvshm' '--enable-discard-path' '--enable-track-vars' '--enable-trans-sid' '--without-oci8' '--with-pear=/usr/share/pear' '--with-imap=shared' '--with-imap-ssl' '--with-ldap=shared' '--with-mysql=shared,/usr' '--enable-memory-limit' '--enable-bcmath' '--enable-shmop' '--enable-versioning' '--with-apxs2=/usr/local/apache-2.0.44/bin/apxs' '--with-kerberos=/usr/kerberos'


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2003-02-11 12:30 UTC]
Could you try the patch at: it should fix the problem. The solution you've proposed is not quite right, while may solve the problem in some cases it is only a temporary fix, E-mail address with couple a hundred \\ in it would still result in a crash.
 [2003-02-11 16:59 UTC]
This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at
In case this was a documentation problem, the fix will show up soon at

In case this was a website problem, the change will show
up on the site and on the mirror sites in short time.
Thank you for the report, and for helping us make PHP better.

PHP Copyright © 2001-2015 The PHP Group
All rights reserved.
Last updated: Sat Oct 10 03:01:30 2015 UTC