Attachment 26093 Details for Bug 63201

[patch] New patch, obsoleting old one

cyrus-imap-2.2.8-security.diff (text/plain), 2.46 KB, created by Sebastian Krahmer on 2004-11-15 20:47:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sebastian Krahmer

Created: 2004-11-15 20:47:13 UTC

Size: 2.46 KB

patch

obsolete

>// Fixes:
>// CAN-2004-1011
>// CAN-2004-1013
>// intwrap in cmd_append() and post increment glitches
>//
>
>--- imapd.c.orig	2004-11-15 11:20:17.000000000 +0100
>+++ imapd.c	2004-11-15 13:39:15.000000000 +0100
>@@ -284,6 +284,8 @@
>     int r;
> 
>     if (!ulen) ulen = strlen(user);
>+    if (ulen > MAX_MAILBOX_NAME)
>+        ulen = MAX_MAILBOX_NAME;
> 
>     if (config_getswitch(IMAPOPT_IMAPMAGICPLUS)) {
> 	/* make a working copy of the auth[z]id */
>@@ -345,6 +347,9 @@
> 
> 	/* make a working copy of the authzid */
> 	if (!rlen) rlen = strlen(requested_user);
>+	if (rlen > MAX_MAILBOX_NAME)
>+	    rlen = MAX_MAILBOX_NAME;
>+
> 	memcpy(userbuf, requested_user, rlen);
> 	userbuf[rlen] = '\0';
> 	requested_user = userbuf;
>@@ -2349,10 +2354,13 @@
>     while (!r && c == ' ') {
> 	/* Grow the stage array, if necessary */
> 	if (numstage == numalloc) {
>+	    if (numalloc > INT_MAX/(2*sizeof(struct appendstage *)))
>+		goto done;
> 	    numalloc *= 2;
> 	    stage = xrealloc(stage, numalloc * sizeof(struct appendstage *));
> 	}
>-	curstage = stage[numstage++] = xzmalloc(sizeof(struct appendstage));
>+	curstage = stage[numstage] = xzmalloc(sizeof(struct appendstage));
>+	++numstage;
> 
> 	/* Parse flags */
> 	c = getword(imapd_in, &arg);
>@@ -2372,7 +2380,8 @@
> 			(char **) xrealloc((char *) curstage->flag, 
> 					   curstage->flagalloc * sizeof(char *));
> 		}
>-		curstage->flag[curstage->nflags++] = xstrdup(arg.s);
>+		curstage->flag[curstage->nflags] = xstrdup(arg.s);
>+		++curstage->nflags;
> 	    } while (c == ' ');
> 	    if (c != ')') {
> 		parseerr = 
>@@ -2770,10 +2779,10 @@
> 		int binsize = 0;
> 
> 		p = section = fetchatt.s + 7;
>-		if (*p == 'P') {
>+		if (!strncmp(p, "PEEK[", 5)) {
> 		    p = section += 5;
> 		}
>-		else if (*p == 'S') {
>+		else if (!strncmp(p, "SIZE[", 5)) {
> 		    p = section += 5;
> 		    binsize = 1;
> 		}
>@@ -2813,7 +2822,7 @@
> 	    else if (!strncmp(fetchatt.s, "BODY[", 5) ||
> 		     !strncmp(fetchatt.s, "BODY.PEEK[", 10)) {
> 		p = section = fetchatt.s + 5;
>-		if (*p == 'P') {
>+		if (!strncmp(p, "PEEK[", 5)) {
> 		    p = section += 5;
> 		}
> 		else {
>@@ -3154,7 +3163,7 @@
>     else if (!strncmp(data, "body[", 5) ||
> 	     !strncmp(data, "body.peek[", 10)) {
> 	p = section = data + 5;
>-	if (*p == 'p') {
>+	if (!strncmp(p, "peek[", 5)) {
> 	    p = section += 5;
> 	}
> 	else {
>@@ -3314,7 +3323,8 @@
> 		flag = (char **)xrealloc((char *)flag,
> 					 flagalloc*sizeof(char *));
> 	    }
>-	    flag[nflags++] = xstrdup(flagname.s);
>+	    flag[nflags] = xstrdup(flagname.s);
>+	    ++nflags;
> 	}
> 
> 	flagsparsed++;

Actions: View | Diff

Attachments on bug 63201: 26056 | 26089 | 26093 | 26228 | 26239 | 26240 | 26347