[evolution-data-server] Bug 770854 - [Camel] Fix buffer over-read due to strchr() misuse
- From: Milan Crha <mcrha src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [evolution-data-server] Bug 770854 - [Camel] Fix buffer over-read due to strchr() misuse
- Date: Mon, 5 Sep 2016 21:20:19 +0000 (UTC)
commit 720809e83f69bedd79476e7ed668f5043c365f1a
Author: Hans Petter Jansson <hpj cl no>
Date: Mon Sep 5 23:19:18 2016 +0200
Bug 770854 - [Camel] Fix buffer over-read due to strchr() misuse
The Content-ID decoder could pass the string terminator as c to strchr(), which
would match it with the terminator in s. The decoder would then iterate past
the terminator and keep going into uninitialized memory.
camel/camel-mime-utils.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/camel/camel-mime-utils.c b/camel/camel-mime-utils.c
index 51ff904..c64f54f 100644
--- a/camel/camel-mime-utils.c
+++ b/camel/camel-mime-utils.c
@@ -3040,7 +3040,7 @@ camel_header_contentid_decode (const gchar *in)
}
/* Eudora has been known to use <.@> as a content-id */
- if (!(buf = header_decode_word (&inptr)) && !strchr (".@", *inptr))
+ if (!(buf = header_decode_word (&inptr)) && (*inptr == '\0' || !strchr (".@", *inptr)))
return NULL;
addr = g_string_new ("");
@@ -3061,7 +3061,7 @@ camel_header_contentid_decode (const gchar *in)
buf = header_decode_word (&inptr);
at = TRUE;
}
- } else if (strchr (".[]", *inptr)) {
+ } else if (*inptr != '\0' && strchr (".[]", *inptr)) {
g_string_append_c (addr, *inptr++);
buf = header_decode_atom (&inptr);
}
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]