RSS

(root)/pkg-mutt/sarge : 5 : debian/patches/imap-buffer-overflow.patch

To get this branch, use:
bzr branch /loggerhead/pkg-mutt/sarge

« back to all changes in this revision

Viewing changes to debian/patches/imap-buffer-overflow.patch

Moritz Muehlenhoff
2006-06-28 17:12:05
Revision ID: deb2bzr-1:jmm@debian.org-20060628171205-5451c797b3e56d58ecdb78bf35f53a7e03b46fa9
Tags: 1.5.9-2sarge2
mutt (1.5.9-2sarge2) stable-security; urgency=high

  * Fix buffer overflow in IMAP parsing code

Show diffs side-by-side

added added

removed removed

debian/patches/imap-buffer-overflow.patch
 
1
From: brendan <brendan>
 
2
Date: Mon, 19 Jun 2006 18:14:03 +0000 (+0000)
 
3
Subject: From: TAKAHASHI Tamotsu <tamo@momonga-linux.org>
 
4
X-Git-Url: http://dev.mutt.org/cgi-bin/gitweb.cgi?p=mutt/.git;a=commitdiff;h=dc0272b749f0e2b102973b7ac43dbd3908507540
 
5
 
 
6
  From: TAKAHASHI Tamotsu <tamo@momonga-linux.org>
 
7
  
 
8
  Fix browse_get_namespace() which could overflow ns[LONG_STRING].
 
9
  (Possible remote vulnerability)
 
10
---
 
11
 
 
12
--- a/imap/browse.c
 
13
+++ b/imap/browse.c
 
14
@@ -505,7 +505,7 @@ static int browse_get_namespace (IMAP_DA
 
15
            if (*s == '\"')
 
16
            {
 
17
              s++;
 
18
-             while (*s && *s != '\"') 
 
19
+             while (*s && *s != '\"' && n < sizeof (ns) - 1) 
 
20
              {
 
21
                if (*s == '\\')
 
22
                  s++;
 
23
@@ -516,12 +516,14 @@ static int browse_get_namespace (IMAP_DA
 
24
                s++;
 
25
            }
 
26
            else
 
27
-             while (*s && !ISSPACE (*s)) 
 
28
+             while (*s && !ISSPACE (*s) && n < sizeof (ns) - 1)
 
29
              {
 
30
                ns[n++] = *s;
 
31
                s++;
 
32
              }
 
33
            ns[n] = '\0';
 
34
+           if (n == sizeof (ns) - 1)
 
35
+             dprint (1, (debugfile, "browse_get_namespace: too long: [%s]\n", ns));
 
36
            /* delim? */
 
37
            s = imap_next_word (s);
 
38
            /* delimiter is meaningless if namespace is "". Why does

Loggerhead 1.17 is a web-based interface for Bazaar branches