[evolution-data-server] Bug 770854 - [Camel] Fix buffer over-read due to strchr() misuse



commit 720809e83f69bedd79476e7ed668f5043c365f1a
Author: Hans Petter Jansson <hpj cl no>
Date:   Mon Sep 5 23:19:18 2016 +0200

    Bug 770854 - [Camel] Fix buffer over-read due to strchr() misuse
    
    The Content-ID decoder could pass the string terminator as c to strchr(), which
    would match it with the terminator in s. The decoder would then iterate past
    the terminator and keep going into uninitialized memory.

 camel/camel-mime-utils.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/camel/camel-mime-utils.c b/camel/camel-mime-utils.c
index 51ff904..c64f54f 100644
--- a/camel/camel-mime-utils.c
+++ b/camel/camel-mime-utils.c
@@ -3040,7 +3040,7 @@ camel_header_contentid_decode (const gchar *in)
        }
 
        /* Eudora has been known to use <.@> as a content-id */
-       if (!(buf = header_decode_word (&inptr)) && !strchr (".@", *inptr))
+       if (!(buf = header_decode_word (&inptr)) && (*inptr == '\0' || !strchr (".@", *inptr)))
                return NULL;
 
        addr = g_string_new ("");
@@ -3061,7 +3061,7 @@ camel_header_contentid_decode (const gchar *in)
                                buf = header_decode_word (&inptr);
                                at = TRUE;
                        }
-               } else if (strchr (".[]", *inptr)) {
+               } else if (*inptr != '\0' && strchr (".[]", *inptr)) {
                        g_string_append_c (addr, *inptr++);
                        buf = header_decode_atom (&inptr);
                }


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]