[TS-827] TSMimeHdrFieldValueStringInsert() can use freed memory to edit headers

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.1.9, 2.1.8, 2.1.7, 2.1.6, 2.1.5, 2.1.4
• Fix Version/s: 3.1.4, 3.1.0, 3.0.0
• Component/s: MIME
• Assignee: Leif Hedstrom
• Reporter: William Bardwell
• Created: 07/Jun/11 15:28
• Updated: 06/Jun/12 00:01
• Resolved: 23/Mar/12 22:41

Description

TSMimeHdrFieldValueStringInsert() and other TSMimeHdrFieldValue*() APIs can use freed memory to edit headers
due to calling HdrHeap::coalesce_str_heaps() from HdrHeap::allocate_str() from
mime_field_value_insert_comma_val() and other mime_field_value_*comma_val() functions while holding pointers
into the HdrHeap.
I have a hacky but functional patch for this.