Mercurial > dovecot > original-hg > dovecot-1.2
changeset 9643:ede60b230594 HEAD
message header parser: Fixed handling NUL characters in header names.
line->name_len was too large and line->middle pointer may have pointed past
allocated memory. These may have caused crashes/corruption (fts, mbox at
least).
| author | Timo Sirainen <tss@iki.fi> |
|---|---|
| date | Wed, 11 May 2011 15:17:02 +0300 |
| parents | e7721f67688a |
| children | d8220ad46879 |
| files | src/lib-mail/message-header-parser.c |
| diffstat | 1 files changed, 3 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/src/lib-mail/message-header-parser.c Sat Mar 12 16:05:57 2011 +0200 +++ b/src/lib-mail/message-header-parser.c Wed May 11 15:17:02 2011 +0300 @@ -311,7 +311,9 @@ colon_pos--; str_truncate(ctx->name, 0); - str_append_n(ctx->name, msg, colon_pos); + /* use buffer_append() so the name won't be truncated if there + are NULs. */ + buffer_append(ctx->name, msg, colon_pos); str_append_c(ctx->name, '\0'); /* keep middle stored also in ctx->name so it's available