[Pkg-mutt-maintainers] Bug#827189: crashes with `free(): invalid next size` when sending to long addresses with gpgme and opportunistic encryption

[Antonio Radici]

Control: tag -1 +confirmed pending
Control: forwarded -1 http://bugs.mutt.org/3873

On Mon, Jun 13, 2016 at 04:41:39PM +0200, chrysn wrote:
> Package: mutt
> Version: 1.6.1-1
> Severity: normal
> 
> with very long recipient addresses (as for example used by github in
> reply-to for their issue tracker) with gpgme and opportunistic
> encryption enabled, mutt crashes with:
> 
>     *** Error in `mutt': free(): invalid next size (fast): 0x0000000001b163e0 ***
>     ======= Backtrace: =========
>     /lib/x86_64-linux-gnu/libc.so.6(+0x71fc5)[0x7f6d42d00fc5]
>     /lib/x86_64-linux-gnu/libc.so.6(+0x77966)[0x7f6d42d06966]
>     /lib/x86_64-linux-gnu/libc.so.6(+0x7814e)[0x7f6d42d0714e]
>     mutt[0x473654]
>     mutt[0x47cbac]
>     mutt[0x4816c5]
>     mutt[0x4141ff]
>     mutt[0x4142ad]
>     mutt[0x46514b]
>     mutt[0x408981]
>     /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7f6d42caf5f0]
>     [...]
>     Aborted

Thanks for your bug report, it is perfectly reproducible.

The fix for this will be in 1.7.0-5 which I will release tonight (along with the
fix for another segfault).