message_parse_received_date() avoid calling message_parse_string(hdr="")

as the latter does hdr = strchr(hdr+1, '\n') and hdr+1 is not allocated.

cunit/message.testc

@@ -1391,4 +1391,17 @@ static void test_parse_bogus_charset_params(void)
 #undef TESTCASE
 }
 
+/*
+ * Verifies that message_parse_received_date() does not read
+ * uninitialized data in the second call to message_parse_string()
+ */
+static void test_parse_received_semicolon(void)
+{
+   static const char msg[] = "Received: abc;\r\n\r\nd";
+   struct body body;
+   memset(&body, 0x45, sizeof(body));
+   CU_ASSERT_EQUAL(message_parse_mapped(msg, sizeof(msg)-1, &body, NULL), 0);
+   CU_ASSERT_STRING_EQUAL(body.received_date, "");
+   message_free_body(&body);
+}
 /* vim: set ft=c: */

imap/message.c

@@ -2010,7 +2010,7 @@ static void message_parse_received_date(const char *hdr, char **hdrp)
     curp--;
 
   /* Didn't find ; - fill in hdrp so we don't look at next received header */
-  if (curp == hdrbuf) {
+  if (curp == hdrbuf || curp[1] == '\0') {
     *hdrp = hdrbuf;
     return;
   }