Mercurial > dovecot > original-hg > dovecot-1.1
changeset 8371:3698dfe0f21c HEAD
message header parser: Fixed handling NUL characters in header names.
line->name_len was too large and line->middle pointer may have pointed past
allocated memory. These may have caused crashes/corruption (fts, mbox at
least).
| author | Timo Sirainen <tss@iki.fi> |
|---|---|
| date | Wed, 11 May 2011 15:17:02 +0300 |
| parents | 9b17de31aac3 |
| children | d9f9ca8c7fe2 |
| files | src/lib-mail/message-header-parser.c |
| diffstat | 1 files changed, 3 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/src/lib-mail/message-header-parser.c Fri Mar 04 19:28:31 2011 +0200 +++ b/src/lib-mail/message-header-parser.c Wed May 11 15:17:02 2011 +0300 @@ -310,7 +310,9 @@ colon_pos--; str_truncate(ctx->name, 0); - str_append_n(ctx->name, msg, colon_pos); + /* use buffer_append() so the name won't be truncated if there + are NULs. */ + buffer_append(ctx->name, msg, colon_pos); str_append_c(ctx->name, '\0'); /* keep middle stored also in ctx->name so it's available