ytnef crashes with Segmentation fault parsing winmail.dat

[arisdizdarevic]

Hi, Yeraze

It seems there are some new segfault errors in last 2 versions of ytnef:
ytnef.x86_64 1.9.3-1 (SOGo Repository)
ytnef.x86_64 2.0.0-1 (SOGo Repository)

OS:
Red Hat Enterprise Linux 8.7 (Ootpa)

Complete mail and extracted winmail.dat file causing segfault in ytnef):
https://www.alcad.si/programi/sogo/mail-with-attachment.eml
https://www.alcad.si/programi/sogo/winmail.dat

Error:
ytnef -h (Yerase TNEF Exporter v2.0.0)
ytnef winmail.dat
ERROR: invalid alloc size 5443388 at ytnef.c : 529, suspected corruption (exceeded 524288 bytes)
Napaka segmentacije (izpis jedra)

If needed I can search for more mails causing segfault and send them to analyze.

Overview of winmail.dat (run with tnefparse -o winmail.dat -b):
Attachments:
Untitled Attachment
image001.jpg

Objects:
TNEF Version
OEM Codepage
Message Class
MAPI Properties
Attachment Rendering Data
Attachment File Name
Attachment Modification Date
Attachment Data
Attachment Meta File
Attachment
Attachment Rendering Data
Attachment Modification Date
Attachment Meta File
Attachment Data
Attachment File Name
Attachment

Properties:
MAPI_ALTERNATE_RECIPIENT_ALLOWED
MAPI_PRIORITY
MAPI_READ_RECEIPT_REQUESTED
MAPI_CONVERSATION_TOPIC
MAPI_CONVERSATION_INDEX
MAPI_DELETE_AFTER_SUBMIT
MAPI_SENTMAIL_ENTRYID
MAPI_SUBMIT_FLAGS
MAPI_PRIMARY_SEND_ACCOUNT
MAPI_NEXT_SEND_ACCT
MAPI_INTERNET_CODEPAGE
MAPI_MESSAGE_LOCALE_ID
MAPI_INTERNET_MAIL_OVERRIDE_FORMAT
MAPI_MESSAGE_EDITOR_FORMAT
MAPI_DEPARTMENT
MAPI_EMAIL_LIST
MAPI_EMAIL3DISPLAY_NAME
MAPI_EMAIL3ENTRY_ID
MAPI_EMAIL3ADDR_TYPE
MAPI_EMAIL3EMAIL_ADDRESS
MAPI_EMAIL3ORIGINAL_ENTRY_ID
MAPI_EMAIL3RICH_TEXT_FORMAT
MAPI_RTF_IN_SYNC
MAPI_MAPPING_SIGNATURE
MAPI_STORE_RECORD_KEY
MAPI_OBJECT_TYPE
MAPI_NATIVE_BODY
MAPI_STORE_SUPPORT_MASK
MAPI_STORE_UNICODE_MASK
MAPI_MDB_PROVIDER
MAPI_TNEF_CORRELATION_KEY
MAPI_RTF_SYNC_BODY_CRC
MAPI_RTF_SYNC_BODY_COUNT
MAPI_RTF_SYNC_PREFIX_COUNT
MAPI_RTF_SYNC_TRAILING_COUNT
MAPI_RTF_SYNC_BODY_TAG

No body found

[Yeraze]

The message you're seeing:

ERROR: invalid alloc size 5443388 at ytnef.c : 529, suspected corruption (exceeded 524288 bytes)

For memory protection, ytnef assumes "unusually large" sections are an indication of a corrupted file. You can redefine what it considers "unusually large" with the -s flag .

[arisdizdarevic]

@Yeraze thank you for prompt answer

I tried as you suggested with -s switch and huge number but the problem persists and it seems -s switch even isn't deployed (I allways get exceeded 524288 bytes (If I'm correct that is only 0,5MB) ... Am I perhaps doing something wrong?

[root@ir-tmp]# ytnef -s 600000000 msg5/winmail.dat
ERROR: invalid alloc size 5443388 at ytnef.c : 529, suspected corruption (exceeded 524288 bytes)
Segmentation fault

Size of winmail.dat file is small:
[root@ir-temp]# du -hs msg5/*
4.0K msg-25923-1.txt
5.3M winmail.dat

[arisdizdarevic]

Hi, Yeraze

It's been while with no answer - with SoGO team we managed to solve segfault problem and they also noticed segfault was caused by "libytnef" and they solved it by catching Exception of your library before sogod-app-crashed.

You can get more info regarding problem on this link:
https://bugs.sogo.nu/view.php?id=5593

It would be really great if you could upgrade ytnef because now ytenf can not extract info of some TNEF-Attachments and mail upon view is empty.

Br, ARis.

[Yeraze]

I updated it to integrate the patch provided on the SOGO board.. does that resolve the issue with these attachments? I need sample attachments I can use to debug otherwise.

[Yeraze]

Using the stream attached above, they run without issue for me, showing 2 attachments (one untitled, one JPEG).

[arisdizdarevic]

Hi, Yeraze

Thank you very much for changes and your time...

Since we run our server in production I will wait for official Repo updates and then update and check.

But as you said if the sample in first post works wiothout segfault than you did a great job.

p.s. If you visit Slovenia don't be a stranger and give me a call aris@alcad.si so we can go on a drink or two (my treat)... ;)

Thank you very much and br,
Aris.