Skip to content

Segfault due to infinite recursion in imap_populate_folder_tree() with some servers

imap_populate_folder_tree() relies on \HasNoChildren mailbox attribute, but it doesn't check required server capabilities. This attribute is defined in IMAP4 extensions. IMAP4 servers that support these extensions must list the keywords CHILDREN or LIST-EXTENDED in their CAPABILITY response. See RFC 3348 and RFC 5258.

If server doesn't support these extensions, it leads to infinite recursion in imap_populate_folder_tree(). For example, see debug output for imap.mail.ru:

DBG[mailwatch-mailbox-imap.c:362] imap_send_login_info(): response from login (101): * CAPABILITY IMAP4rev1 ID XLIST UIDPLUS UNSELECT MOVE LIST-STATUS
00002 OK Authentication successful

TRACE[mailwatch-mailbox-imap.c:377] imap_send_login_info(): leaving (success)
TRACE[mailwatch-mailbox-imap.c:919] imap_populate_folder_tree(): entering (0x55bacc99fa40, , 0x55bacca08b30)
DBG[mailwatch-mailbox-imap.c:925] imap_populate_folder_tree(): sent LIST: '00003 LIST "" "%"
'
DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Inbox) "/" "INBOX"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Spam) "/" "&BCEEPwQwBDw-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Sent) "/" "&BB4EQgQ,BEAEMAQyBDsENQQ9BD0ESwQ1-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Drafts) "/" "&BCcENQRABD0EPgQyBDgEOgQ4-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Trash) "/" "&BBoEPgRABDcEOAQ9BDA-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: 00003 OK LIST done

TRACE[mailwatch-mailbox-imap.c:919] imap_populate_folder_tree(): entering (0x55bacc99fa40, INBOX/, 0x55bacca08b60)
DBG[mailwatch-mailbox-imap.c:925] imap_populate_folder_tree(): sent LIST: '00004 LIST "INBOX/" "%"
'
DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Inbox) "/" "INBOX"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Spam) "/" "&BCEEPwQwBDw-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Sent) "/" "&BB4EQgQ,BEAEMAQyBDsENQQ9BD0ESwQ1-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Drafts) "/" "&BCcENQRABD0EPgQyBDgEOgQ4-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Trash) "/" "&BBoEPgRABDcEOAQ9BDA-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: 00004 OK LIST done

TRACE[mailwatch-mailbox-imap.c:919] imap_populate_folder_tree(): entering (0x55bacc99fa40, INBOX/INBOX/, 0x55bacca08b90)
DBG[mailwatch-mailbox-imap.c:925] imap_populate_folder_tree(): sent LIST: '00005 LIST "INBOX/INBOX/" "%"
'
DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Inbox) "/" "INBOX"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Spam) "/" "&BCEEPwQwBDw-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Sent) "/" "&BB4EQgQ,BEAEMAQyBDsENQQ9BD0ESwQ1-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Drafts) "/" "&BCcENQRABD0EPgQyBDgEOgQ4-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Trash) "/" "&BBoEPgRABDcEOAQ9BDA-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: 00005 OK LIST done

TRACE[mailwatch-mailbox-imap.c:919] imap_populate_folder_tree(): entering (0x55bacc99fa40, INBOX/INBOX/INBOX/, 0x7f2854017a10)
DBG[mailwatch-mailbox-imap.c:925] imap_populate_folder_tree(): sent LIST: '00006 LIST "INBOX/INBOX/INBOX/" "%"
'
DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Inbox) "/" "INBOX"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Spam) "/" "&BCEEPwQwBDw-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Sent) "/" "&BB4EQgQ,BEAEMAQyBDsENQQ9BD0ESwQ1-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Drafts) "/" "&BCcENQRABD0EPgQyBDgEOgQ4-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Trash) "/" "&BBoEPgRABDcEOAQ9BDA-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: 00006 OK LIST done

...

TRACE[mailwatch-mailbox-imap.c:919] imap_populate_folder_tree(): entering (0x55bacc99fa40, INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/I, 0x7f28540d7350)
DBG[mailwatch-mailbox-imap.c:925] imap_populate_folder_tree(): sent LIST: '00454 LIST "INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/INBOX/I" "%"
'
DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Inbox) "/" "INBOX"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Spam) "/" "&BCEEPwQwBDw-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Sent) "/" "&BB4EQgQ,BEAEMAQyBDsENQQ9BD0ESwQ1-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Drafts) "/" "&BCcENQRABD0EPgQyBDgEOgQ4-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: * LIST (\Trash) "/" "&BBoEPgRABDcEOAQ9BDA-"

DBG[mailwatch-mailbox-imap.c:237] imap_recv_command(): trying to get line
DBG[mailwatch-mailbox-imap.c:239] imap_recv_command(): got line: 00454 OK LIST done

xfce4-panel(external): mailwatch-14: child is unembedded
xfce4-panel(external): mailwatch-14: child exited with status 139
xfce4-panel-Message: 21:59:17.716: Plugin mailwatch-14 has been automatically restarted after crash.
xfce4-panel(external): mailwatch-14: scheduled a respawn of the child
$ journalctl | grep 'mailwatch'
nov 09 21:59:17 xubuntu kernel: panel-14-mailwa[7781]: segfault at 7f285e08d8a8 ip 00007f28632a0202 sp 00007f285e08d890 error 7 in libmailwatch.so[7f2863291000+2a000]
Edited by Ghost User