StackOverflowException upon parsing malformed message

[MannyDustbeard]

When malformed message is loaded, StackOverflowException occurs. Expected behavior is to throw a regular exception that can be handed by code. StackOverflowException terminates running application and there is no way to recover.

var path = @"StackOverflowMimeMessageExample.txt";
using (var reader = File.OpenRead(path))
{
    // This works
    var headers = HeaderList.Load(reader);
    reader.Seek(0, SeekOrigin.Begin);

    // This throws StackOverflowException and causes process teardown
    var msg = MimeMessage.Load(reader);
}

Below is StackOverflow message example :

StackOverflowMimeMessageExample.txt

[jstedfast]

Are you sure? Because I just compiled and ran your code and it worked fine w/o any stack overflow exceptions.

I tried your StackOverflowMimeMessageExample.txt file in both Unix format and DOS format. Same results, no stack overflow.

[jstedfast]

If I duplicated the To header 10x, it finally crashed for me.

The problem is that the ':' inside of the encoded word tokens is not only invalid (not allowed within encoded-word tokens in address headers), it also signifies to the parser that everything preceding the ':' is the name of an address group and everything after it is a list of addresses.

Since group addresses can be recursive and the fact that it was a string of date strings, each digit in the date signified the name of a new group and it recursed forever and ever, eventually causing a stack overflow.

I'm adding a new ParserOptions property called MaxAddressGroupDepth (with a default value of 3 I think) that will prevent the parser from recursing these types of addresses more than X number of times before bailing out.

[MannyDustbeard]

I noticed that exception if thrown much quicker on Windows/.NET and on Linux it just needs more malformed lines in the header, like you noticed too. Thank you for the quick solution!

[peteroupc]

Under RFC 5322 section 3.4, group syntax can't even be recursive -- groups within groups are not allowed in header fields that allow group syntax.

[jstedfast]

@peteroupc You are indeed correct.