mirror of
https://git.freebsd.org/ports.git
synced 2025-07-08 21:09:17 -04:00
45dff59779
- Add fix for recent IMAP buffer overflow vulnerability. Approved by: ahze (mentor) Security: VuXML d2a43243-087b-11db-bc36-0008743bf21a
26 lines
884 B
C
26 lines
884 B
C
--- imap/browse.c.orig Thu Aug 11 13:13:13 2005
|
|
+++ imap/browse.c Sat Jul 1 16:30:28 2006
|
|
@@ -481,7 +481,7 @@
|
|
|
|
if (*s == '\"') {
|
|
s++;
|
|
- while (*s && *s != '\"') {
|
|
+ while (*s && *s != '\"' && n < sizeof (ns) - 1) {
|
|
if (*s == '\\')
|
|
s++;
|
|
ns[n++] = *s;
|
|
@@ -491,11 +491,13 @@
|
|
s++;
|
|
}
|
|
else
|
|
- while (*s && !ISSPACE (*s)) {
|
|
+ while (*s && !ISSPACE (*s) && n < sizeof (ns) - 1) {
|
|
ns[n++] = *s;
|
|
s++;
|
|
}
|
|
ns[n] = '\0';
|
|
+ if (n == sizeof (ns) - 1)
|
|
+ debug_print (1, ("browse_get_namespace: too long: [%s]\n", ns));
|
|
/* delim? */
|
|
s = imap_next_word (s);
|
|
/* delimiter is meaningless if namespace is "". Why does
|