Skip to content

CRITICAL: Multi-part Mail at END of stream results in a CPU-Heavy INFINITE loop! #206

Open
@rlaphoenix

Description

@rlaphoenix

MailMessage's string body = parseMime(...)
can land in an INFINITE loop.

This took me about a month of security testing and research.
This is CRITICAL to be fixed.

The loop occurs at Line 190' while loop
https://github.com/andyedinborough/aenetmail/blob/master/MailMessage.cs#L190

If a multi-part message (has nestedBoundary) is at the very end of a stream, it will do the recursive parseMime to handle nestedBoundary fine, but when its passed parseMime and is now in the while loop to get the streams position to the next boundary, it will seriously fk up, since it will return ")" (probably empty lines or \n, \r before ")" e.t.c) then it will result in a non-responsive stream, and all the reader.ReadLine attempts will get a -1 from the ReadByte resulting in an empty string, resulting in it ALWAYS looping.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions