mutt crashes on opening mail with special chars in To: header

[Tv]

Binary package hint: mutt

Put this email in a maildir (mkdir crash crash/{cur,new,tmp}, cat >crash/new/foo) and try to open it in mutt.
Mutt will crash every time, saying "*** glibc detected *** mutt: double free or corruption (!prev): 0x00000000018e21d0 ***" Most of the message is obscured by ncurses. Running intrepid, mutt 1.5.18-4ubuntu1. Might be hard to exploit, as glibc is explicitly triggering an abort, but still might be doable, or same bug could cause other corruption.

Return-Path: <email address hidden>
Received: from 152.209.104.58 by ; Thu, 15 Jan 2009 16:44:52 +0200
Message-ID: <H[20
Date: Wed, 14 Jan 2009 22:34:28 +0000 (UTC)
From: <email address hidden>
To: undisclosed-recipients:;

[Caspar Clemens Mierau (leitmedium)]

I hereby confirm this issue on a up to date Intrepid. Attached you'll find a gdb backtrage showing the crash. Need to find out if this still occurs on Jaunty. I will update this bugs subject.

[Caspar Clemens Mierau (leitmedium)]

This crash also occurs on an up to date Jaunty.

[Caspar Clemens Mierau (leitmedium)]

Tested on manually compiled upstream version 5.1.19 (Jaunty has 5.1.18) - the crash does *NOT* occur there. Therefore versions prior to 5.1.19 seem to be affected.

[Caspar Clemens Mierau (leitmedium)]

Actually it's not the Message-Id - the problem is the To:-adress with the ":" right before the ";". It seems this confuses the header counter / copy method.