mail crashes on invalid To field

[zelivans]

This is another bug I found by fuzzing mail.

Raw crash

/home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/parser_tools.rb:7:in `chars': bad value for range (ArgumentError)
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/parsers/address_lists_parser.rb:32341:in `parse'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/elements/address_list.rb:25:in `initialize'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/fields/common_address_field.rb:27:in `new'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/fields/common_address_field.rb:27:in `element'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/fields/common_field.rb:39:in `tap'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/fields/common_field.rb:39:in `parse'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/fields/common_field.rb:35:in `value='
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/fields/common_field.rb:24:in `initialize'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/fields/named_structured_field.rb:8:in `initialize'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/fields/common_address_field.rb:23:in `initialize'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/fields/common_field.rb:12:in `new'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/fields/common_field.rb:12:in `parse'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/field.rb:267:in `parse_field'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/field.rb:256:in `create_field'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/field.rb:183:in `field'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/field.rb:229:in `method_missing'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/field_list.rb:30:in `add_field'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/header.rb:100:in `block in fields='
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/header.rb:98:in `each'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/header.rb:98:in `fields='
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/header.rb:224:in `split_header'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/header.rb:56:in `initialize'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/message.rb:429:in `new'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/message.rb:429:in `header='
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/message.rb:1979:in `parse_message'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/message.rb:2113:in `init_with_string'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/message.rb:135:in `initialize'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/mail.rb:51:in `new'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/mail.rb:51:in `new'
	from /home/ariel/afl-kisaten/private/sandbox/mail/mail/lib/mail/mail.rb:169:in `read'
	from tst.rb:2:in `<main>'

Input

From:0000(0000000000000000000) <0000(00000000000)@0000000000(00000000)>
To:0 00000(00000000000) 0   :0000000a00.000@(0000000000000)00000000000000;,   000010@00000000000,000000 <0000@00000000> (00000000000000); (00000000000000000000)

Explanation

It is possible to cause mail to crash with a malformed To field. The crash is caused when from_bytes is nil in the chars method of ParserTools. This parameter shouldn't be nil so the fix should come from preventing this in address_lists_parser.rb.

[jeremy]

Nice find. Thanks for fuzzing, @zelivans!