Attachment 26228 Details for Bug 63201

[patch] the patch upstream is using

imapd-buf (text/plain), 3.04 KB, created by Sebastian Krahmer on 2004-11-19 18:33:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sebastian Krahmer

Created: 2004-11-19 18:33:27 UTC

Size: 3.04 KB

patch

obsolete

>Index: imapd.c
>===================================================================
>RCS file: /afs/andrew.cmu.edu/system/cvs/src/cyrus/imap/imapd.c,v
>retrieving revision 1.485
>retrieving revision 1.488
>diff -u -r1.485 -r1.488
>--- imapd.c	16 Sep 2004 17:58:53 -0000	1.485
>+++ imapd.c	17 Nov 2004 22:29:03 -0000	1.488
>@@ -38,7 +38,7 @@
>  * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
>  */
> 
>-/* $Id: imapd.c,v 1.485 2004/09/16 17:58:53 ken3 Exp $ */
>+/* $Id: imapd.c,v 1.488 2004/11/17 22:29:03 shadow Exp $ */
> 
> #include <config.h>
> 
>@@ -287,6 +287,10 @@
> 
>     if (config_getswitch(IMAPOPT_IMAPMAGICPLUS)) {
> 	/* make a working copy of the auth[z]id */
>+	if (ulen > MAX_MAILBOX_NAME) {
>+	    sasl_seterror(conn, 0, "buffer overflow while canonicalizing");
>+	    return SASL_BUFOVER;
>+	}
> 	memcpy(userbuf, user, ulen);
> 	userbuf[ulen] = '\0';
> 	user = userbuf;
>@@ -345,6 +349,10 @@
> 
> 	/* make a working copy of the authzid */
> 	if (!rlen) rlen = strlen(requested_user);
>+	if (rlen > MAX_MAILBOX_NAME) {
>+	    sasl_seterror(conn, 0, "buffer overflow while proxying");
>+	    return SASL_BUFOVER;
>+	}
> 	memcpy(userbuf, requested_user, rlen);
> 	userbuf[rlen] = '\0';
> 	requested_user = userbuf;
>@@ -2347,11 +2355,14 @@
>     while (!r && c == ' ') {
> 	/* Grow the stage array, if necessary */
> 	if (numstage == numalloc) {
>+	    /* Avoid integer wrap as arg to xrealloc */
>+	    if (numalloc > INT_MAX/(2*sizeof(struct appendstage *)))
>+		goto done;
> 	    numalloc *= 2;
> 	    stage = xrealloc(stage, numalloc * sizeof(struct appendstage *));
> 	}
>-	curstage = stage[numstage++] = xzmalloc(sizeof(struct appendstage));
>-
>+	curstage = stage[numstage] = xzmalloc(sizeof(struct appendstage));
>+	numstage++;
> 	/* Parse flags */
> 	c = getword(imapd_in, &arg);
> 	if  (c == '(' && !arg.s[0]) {
>@@ -2370,7 +2381,8 @@
> 			(char **) xrealloc((char *) curstage->flag, 
> 					   curstage->flagalloc * sizeof(char *));
> 		}
>-		curstage->flag[curstage->nflags++] = xstrdup(arg.s);
>+		curstage->flag[curstage->nflags] = xstrdup(arg.s);
>+		curstage->nflags++;
> 	    } while (c == ' ');
> 	    if (c != ')') {
> 		parseerr = 
>@@ -2764,10 +2776,10 @@
> 		int binsize = 0;
> 
> 		p = section = fetchatt.s + 7;
>-		if (*p == 'P') {
>+		if (!strncmp(p, "PEEK[", 5)) {
> 		    p = section += 5;
> 		}
>-		else if (*p == 'S') {
>+		else if (!strncmp(p, "SIZE[", 5)) {
> 		    p = section += 5;
> 		    binsize = 1;
> 		}
>@@ -2807,7 +2819,7 @@
> 	    else if (!strncmp(fetchatt.s, "BODY[", 5) ||
> 		     !strncmp(fetchatt.s, "BODY.PEEK[", 10)) {
> 		p = section = fetchatt.s + 5;
>-		if (*p == 'P') {
>+		if (!strncmp(p, "PEEK[", 5)) {
> 		    p = section += 5;
> 		}
> 		else {
>@@ -3148,7 +3160,7 @@
>     else if (!strncmp(data, "body[", 5) ||
> 	     !strncmp(data, "body.peek[", 10)) {
> 	p = section = data + 5;
>-	if (*p == 'p') {
>+	if (!strncmp(p, "peek[", 5)) {
> 	    p = section += 5;
> 	}
> 	else {
>@@ -3308,7 +3320,8 @@
> 		flag = (char **)xrealloc((char *)flag,
> 					 flagalloc*sizeof(char *));
> 	    }
>-	    flag[nflags++] = xstrdup(flagname.s);
>+	    flag[nflags] = xstrdup(flagname.s);
>+	    nflags++;
> 	}
> 
> 	flagsparsed++;

Actions: View | Diff

Attachments on bug 63201: 26056 | 26089 | 26093 | 26228 | 26239 | 26240 | 26347