Bug 166718

declare -x MALLOC_PERTURB_="204"
mutt -f base64spam (attached)

Program received signal SIGSEGV, Segmentation fault.
0x0000000000425480 in mutt_decode_base64 (s=0x7ffffff63320, len=574, istext=1,
cd=0x7b40b0) at handler.c:308
308         c2 = base64val (buf[1]);
(gdb) bt
#0  0x0000000000425480 in mutt_decode_base64 (s=0x7ffffff63320, len=574,
istext=1, cd=0x7b40b0) at handler.c:308
#1  0x0000000000427727 in mutt_decode_attachment (b=0x7b3970, s=0x7ffffff63320)
at handler.c:1728
#2  0x0000000000427a4d in mutt_body_handler (b=0x7b3970, s=0x7ffffff63320) at
handler.c:1897
#3  0x0000000000427fa7 in alternative_handler (a=0x7b3850, s=0x7ffffff63320) at
handler.c:1324
#4  0x0000000000427a76 in mutt_body_handler (b=0x7b3850, s=0x7ffffff63320) at
handler.c:1921
#5  0x0000000000428373 in multipart_handler (a=0x79a680, s=0x7ffffff63320) at
handler.c:1479
#6  0x0000000000427a76 in mutt_body_handler (b=0x79a680, s=0x7ffffff63320) at
handler.c:1921
#7  0x0000000000414640 in _mutt_copy_message (fpout=0x7b3e40, fpin=0x777280,
hdr=0x79a150, body=0x79a680, flags=76, chflags=150) at copy.c:535
#8  0x000000000041497b in mutt_copy_message (fpout=0x7b3e40, src=Variable "src"
is not available.
) at copy.c:603
#9  0x000000000040ef1e in mutt_display_message (cur=0x79a150) at commands.c:142
#10 0x0000000000418087 in mutt_index_menu () at curs_main.c:1070
#11 0x000000000042e9f2 in main (argc=3, argv=0x7ffffff64818) at main.c:842
#12 0x000000331111ccaf in __libc_start_main () from /lib64/libc.so.6
#13 0x000000000040608a in _start ()
#14 0x00007ffffff64808 in ?? ()
#15 0x0000000000000000 in ?? ()
(gdb)

This is dependant on the MALLOC_PERTURB_ stuff in rawhide, so I don't know if
this affects earlier releases, or is exploitable.

Setting security sensitive just in case.