mail_fetch_body() may return empty string without updating len parameter

[Volodymyr Kolesnykov]

See Bug #617849 where this behavior crashes PHP.

In brief, when mail_fetch_body() is passed very long section (strlen(section) > 1004), mail_fetch_body() returns an empty string but does not set len parameter to zero. If the calling application has not set len to zero before calling mail_fetch_body(), it will likely to crash because len parameter will contain garbage.

$ lsb_release -rd
Description: Ubuntu 10.04.1 LTS
Release: 10.04

$ LC_ALL=C apt-cache policy libc-client2007e
libc-client2007e:
  Installed: 8:2007e~dfsg-3.1
  Candidate: 8:2007e~dfsg-3.1
  Version table:
     8:2007e~dfsg-3.1 0
        500 http://ua.archive.ubuntu.com/ubuntu/ lucid/universe Packages
 *** 8:2007e~dfsg-3.1 0
        100 /var/lib/dpkg/status

[Volodymyr Kolesnykov (sjinks)]

Patch against src/c-client/mail.c that solves the problem.

[Launchpad Janitor (janitor)]

This bug was fixed in the package uw-imap - 8:2007e~dfsg-3.1ubuntu3

---------------
uw-imap (8:2007e~dfsg-3.1ubuntu3) oneiric; urgency=low

  * Apply patch from Vladimir Kolesnikov to properly zero out len
    parameter when mail_fetch_body() returns an empty string.
    (LP: #617876)
 -- Daniel T Chen <email address hidden> Thu, 28 Jul 2011 18:38:08 -0400