[tin-bugs] Heap Buffer Overflow in tin 2.6.6 via Header Display-Name Quoting

[Tristan]

Hello,

I am writing to report a heap buffer overflow vulnerability in tin
2.6.6 (2026-05-24), confirmed by code trace against Debian package
2.6.6~20260524-1.

Summary of findings:

1. Heap Buffer Overflow via From/To/Cc Header Display-Name Quoting
   (CVSS 8.1)

When tin parses From, To, Cc, Bcc, or Reply-To headers from NNTP
articles, parse_mb_list_header() in src/rfc2046.c writes the
reformatted address back into the original line buffer. The
quote_display_name() function expands the display-name by escaping
backslashes and double-quotes (each character is doubled, plus
surrounding quotes are added), but the sprintf() call that writes
the result back uses a buffer sized for the original, shorter input.

A malicious Usenet article with backslashes or double-quote
characters in the display-name portion of a From header can trigger
a heap buffer overflow when the victim reads the article. The
overflow size is proportional to the number of escapable characters,
up to ~1023 bytes. This affects all five headers processed through
parse_mb_list_header() (From, To, Cc, Bcc, Reply-To).

Individual details are attached.

I would appreciate an acknowledgment of receipt.

Thank you and please let me know if you need anything else.

Regards,
Tristan


========================================================================
Heap Buffer Overflow via From/To/Cc Header Display-Name Quoting
================================================================
CVSS 3.1: 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
CWE: CWE-122 (Heap-based Buffer Overflow)
Auth: None (malicious NNTP article)
Version: 2.6.6 (2026-05-24, latest; Debian 2.6.6~20260524-1)
Validation: Code trace

File: src/rfc2046.c, parse_mb_list_header() and quote_display_name()

Root Cause:

When tin parses From, To, Cc, Bcc, or Reply-To headers from NNTP
articles, parse_mb_list_header() writes the reformatted address back
into the original line buffer. The problem is that quote_display_name()
expands the display-name during quoting, producing output longer than
the input, but the output buffer was sized for the original value.

parse_mb_list_header() (rfc2046.c:1268) receives buf - a pointer to the
dynamic line buffer from tin_fgets(). It saves a write pointer
ptr = buf + header_offset, copies the value to a separate buffer, clears
*ptr = '\0', then reformats each address back into ptr via sprintf().

For route-style addresses (name <addr>), the display-name passes through
gnksa_split_from() (truncates to 1023 bytes), rfc1522_decode() (output
<= input length), convert_to_printable() (same length), and finally
quote_display_name() - which EXPANDS the string.

quote_display_name() (rfc2046.c:1166) wraps the name in double quotes
and escapes each backslash and double-quote character by doubling it.
For a name consisting of N backslashes, the output is 2*N + 2 bytes
(each '\' becomes '\\', plus surrounding '"'). The function correctly
allocates the expanded buffer:

    to = disp_name = my_malloc(len + quote_cnt + 1);
    *to++ = '"';
    while (*ptr) {
        case '\\':
            // outputs '\\' for each '\'
    }
    *to++ = '"';

But the caller then writes this expanded string back into the original
line buffer, which only had space for the unexpanded value:

    sprintf(ptr, "%s <%s>", new_name, addr);  // OVERFLOW

For example, a From header with 32 backslashes in the display-name
expands to 66 bytes (64 escaped chars + 2 quotes) via
quote_display_name(), then sprintf() writes 66 + 3 + strlen(addr) + 1
bytes into a buffer that only had space for the original ~50-byte value.

This overflow affects all five headers processed by
parse_mb_list_header(): From (line 1399), To (1404), Cc (1409),
Bcc (1414), and Reply-To (1434).

Impact:

A malicious Usenet article or rogue NNTP server causes heap corruption
when the victim reads the article. The overflow can corrupt adjacent heap
metadata and objects, potentially leading to denial of service (crash) or
arbitrary code execution. The overflow size is approximately equal to the
number of backslash/double-quote characters in the display-name, up to
~1023 bytes.

Trigger: Post an NNTP article with a From header containing many
backslashes in the display-name (e.g., 32+ backslashes followed by
<attacker at example.com>). The overflow occurs when the victim reads the
article in tin.