Attachment 32969 Details for Bug 72801

[patch] sylpheed-0.8.10claws-mimedecoding-sec.diff

sylpheed-0.8.10claws-mimedecoding-sec.diff (text/plain), 8.82 KB, created by Thomas Biege on 2005-03-31 09:25:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2005-03-31 09:25:37 UTC

Size: 8.82 KB

patch

obsolete

>diff -pru -X xcld sylpheed-0.8.10claws.orig/src/codeconv.c sylpheed-0.8.10claws.sec/src/codeconv.c
>--- sylpheed-0.8.10claws.orig/src/codeconv.c	2005-03-31 10:58:18.000000000 +0200
>+++ sylpheed-0.8.10claws.sec/src/codeconv.c	2005-03-31 10:56:32.000000000 +0200
>@@ -1177,7 +1177,7 @@ const gchar *conv_get_current_locale(voi
> 	return cur_locale;
> }
> 
>-void conv_unmime_header_overwrite(gchar *str)
>+void conv_unmime_header_overwrite(gchar *str, gint strsize)
> {
> 	gchar *buf;
> 	gint buflen;
>@@ -1189,12 +1189,12 @@ void conv_unmime_header_overwrite(gchar 
> 		buflen = strlen(str) * 2 + 1;
> 		Xalloca(buf, buflen, return);
> 		conv_anytodisp(buf, buflen, str);
>-		unmime_header(str, buf);
>+		unmime_header(str, strsize, buf);
> 	} else {
> 		buflen = strlen(str) + 1;
> 		Xalloca(buf, buflen, return);
>-		unmime_header(buf, str);
>-		strncpy2(str, buf, buflen);
>+		unmime_header(buf, buflen, str);
>+		strncpy2(str, buf, strsize);
> 	}
> }
> 
>@@ -1203,6 +1203,8 @@ void conv_unmime_header(gchar *outbuf, g
> {
> 	CharSet cur_charset;
> 
>+	g_return_if_fail(str != NULL);
>+
> 	cur_charset = conv_get_current_charset();
> 
> 	if (cur_charset == C_EUC_JP) {
>@@ -1212,9 +1214,9 @@ void conv_unmime_header(gchar *outbuf, g
> 		buflen = strlen(str) * 2 + 1;
> 		Xalloca(buf, buflen, return);
> 		conv_anytodisp(buf, buflen, str);
>-		unmime_header(outbuf, buf);
>+		unmime_header(outbuf, outlen, buf);
> 	} else
>-		unmime_header(outbuf, str);
>+		unmime_header(outbuf, outlen, str);
> }
> 
> #define MAX_LINELEN	76
>diff -pru -X xcld sylpheed-0.8.10claws.orig/src/codeconv.h sylpheed-0.8.10claws.sec/src/codeconv.h
>--- sylpheed-0.8.10claws.orig/src/codeconv.h	2003-02-04 09:37:08.000000000 +0100
>+++ sylpheed-0.8.10claws.sec/src/codeconv.h	2005-03-31 10:56:32.000000000 +0200
>@@ -159,7 +159,7 @@ const gchar *conv_get_outgoing_charset_s
> 
> const gchar *conv_get_current_locale		(void);
> 
>-void conv_unmime_header_overwrite	(gchar		*str);
>+void conv_unmime_header_overwrite	(gchar		*str, gint strsize);
> void conv_unmime_header			(gchar		*outbuf,
> 					 gint		 outlen,
> 					 const gchar	*str,
>diff -pru -X xcld sylpheed-0.8.10claws.orig/src/compose.c sylpheed-0.8.10claws.sec/src/compose.c
>--- sylpheed-0.8.10claws.orig/src/compose.c	2005-03-31 10:58:18.000000000 +0200
>+++ sylpheed-0.8.10claws.sec/src/compose.c	2005-03-31 10:56:32.000000000 +0200
>@@ -1431,12 +1431,12 @@ static gint compose_parse_header(Compose
> 	fclose(fp);
> 
> 	if (hentry[H_REPLY_TO].body != NULL) {
>-		conv_unmime_header_overwrite(hentry[H_REPLY_TO].body);
>+		conv_unmime_header_overwrite(hentry[H_REPLY_TO].body, strlen(hentry[H_REPLY_TO].body));
> 		compose->replyto = hentry[H_REPLY_TO].body;
> 		hentry[H_REPLY_TO].body = NULL;
> 	}
> 	if (hentry[H_CC].body != NULL) {
>-		conv_unmime_header_overwrite(hentry[H_CC].body);
>+		conv_unmime_header_overwrite(hentry[H_CC].body, strlen(hentry[H_CC].body));
> 		compose->cc = hentry[H_CC].body;
> 		hentry[H_CC].body = NULL;
> 	}
>@@ -1452,19 +1452,19 @@ static gint compose_parse_header(Compose
> 	}
> 	if (hentry[H_BCC].body != NULL) {
> 		if (compose->mode == COMPOSE_REEDIT) {
>-			conv_unmime_header_overwrite(hentry[H_BCC].body);
>+			conv_unmime_header_overwrite(hentry[H_BCC].body, strlen(hentry[H_BCC].body));
> 			compose->bcc = hentry[H_BCC].body;
> 		} else
> 			g_free(hentry[H_BCC].body);
> 		hentry[H_BCC].body = NULL;
> 	}
> 	if (hentry[H_NEWSGROUPS].body != NULL) {
>-		conv_unmime_header_overwrite(hentry[H_NEWSGROUPS].body);
>+		conv_unmime_header_overwrite(hentry[H_NEWSGROUPS].body, strlen(hentry[H_NEWSGROUPS].body));
> 		compose->newsgroups = hentry[H_NEWSGROUPS].body;
> 		hentry[H_NEWSGROUPS].body = NULL;
> 	}
> 	if (hentry[H_FOLLOWUP_TO].body != NULL) {
>-		conv_unmime_header_overwrite(hentry[H_FOLLOWUP_TO].body);
>+		conv_unmime_header_overwrite(hentry[H_FOLLOWUP_TO].body, strlen(hentry[H_FOLLOWUP_TO].body));
> 		compose->followup_to = hentry[H_FOLLOWUP_TO].body;
> 		hentry[H_FOLLOWUP_TO].body = NULL;
> 	}
>diff -pru -X xcld sylpheed-0.8.10claws.orig/src/procmime.c sylpheed-0.8.10claws.sec/src/procmime.c
>--- sylpheed-0.8.10claws.orig/src/procmime.c	2005-03-31 10:58:18.000000000 +0200
>+++ sylpheed-0.8.10claws.sec/src/procmime.c	2005-03-31 10:56:32.000000000 +0200
>@@ -375,12 +375,9 @@ void procmime_scan_content_type(MimeInfo
> 			if (!strcasecmp(attr, "charset"))
> 				mimeinfo->charset = g_strdup(value);
> 			else if (!strcasecmp(attr, "name")) {
>-				gchar *tmp;
>-				size_t len;
>+				gchar tmp[BUFFSIZE];
> 
>-				len = strlen(value) + 1;
>-				Xalloca(tmp, len, return);
>-				conv_unmime_header(tmp, len, value, NULL);
>+				conv_unmime_header(tmp, sizeof(tmp), value, NULL);
> 				g_free(mimeinfo->name);
> 				/*pgp signatures should NOT have a name */
> 				if (mimeinfo->content_type 
>@@ -442,12 +439,10 @@ void procmime_scan_content_disposition(M
> 
> 		if (*value) {
> 			if (!strcasecmp(attr, "filename")) {
>-				gchar *tmp;
>-				size_t len;
>+				gchar tmp[BUFFSIZE];
> 
>-				len = strlen(value) + 1;
>-				Xalloca(tmp, len, return);
>-				conv_unmime_header(tmp, len, value, NULL);
>+				conv_unmime_header(tmp, sizeof(tmp), value,
>+						   NULL);
> 				g_free(mimeinfo->filename);
> 				/*pgp signatures should NOT have a name */
> 				if (mimeinfo->content_type 
>diff -pru -X xcld sylpheed-0.8.10claws.orig/src/textview.c sylpheed-0.8.10claws.sec/src/textview.c
>--- sylpheed-0.8.10claws.orig/src/textview.c	2003-02-04 09:40:04.000000000 +0100
>+++ sylpheed-0.8.10claws.sec/src/textview.c	2005-03-31 11:04:16.000000000 +0200
>@@ -706,6 +706,7 @@ static void textview_show_html(TextView 
> 		        textview_write_line(textview, str, NULL);
> 	        }
> 	}
>+	textview_write_line(textview, "\n", NULL);
> 	
> 	html_parser_destroy(parser);
> }
>diff -pru -X xcld sylpheed-0.8.10claws.orig/src/unmime.c sylpheed-0.8.10claws.sec/src/unmime.c
>--- sylpheed-0.8.10claws.orig/src/unmime.c	2005-03-31 10:58:18.000000000 +0200
>+++ sylpheed-0.8.10claws.sec/src/unmime.c	2005-03-31 10:56:32.000000000 +0200
>@@ -28,13 +28,14 @@
> #include "codeconv.h"
> #include "base64.h"
> #include "quoted-printable.h"
>+#include "utils.h"
> 
> #define ENCODED_WORD_BEGIN	"=?"
> #define ENCODED_WORD_END	"?="
> 
> /* Decodes headers based on RFC2045 and RFC2047. */
> 
>-void unmime_header(gchar *out, const gchar *str)
>+void unmime_header(gchar *out, gint outlen, const gchar *str)
> {
> 	const gchar *p = str;
> 	gchar *outp = out;
>@@ -51,35 +52,45 @@ void unmime_header(gchar *out, const gch
> 
> 		eword_begin_p = strstr(p, ENCODED_WORD_BEGIN);
> 		if (!eword_begin_p) {
>-			strcpy(outp, p);
>+			strncpy2(outp, p, outlen);
> 			return;
> 		}
> 		encoding_begin_p = strchr(eword_begin_p + 2, '?');
> 		if (!encoding_begin_p) {
>-			strcpy(outp, p);
>+			strncpy2(outp, p, outlen);
> 			return;
> 		}
> 		text_begin_p = strchr(encoding_begin_p + 1, '?');
> 		if (!text_begin_p) {
>-			strcpy(outp, p);
>+			strncpy2(outp, p, outlen);
> 			return;
> 		}
> 		eword_end_p = strstr(text_begin_p + 1, ENCODED_WORD_END);
> 		if (!eword_end_p) {
>-			strcpy(outp, p);
>+			strncpy2(outp, p, outlen);
> 			return;
> 		}
> 
> 		if (p == str) {
>+			if (eword_begin_p - p > outlen - 1) {
>+				strncpy2(outp, p, outlen);
>+				return;
>+			}
> 			memcpy(outp, p, eword_begin_p - p);
> 			outp += eword_begin_p - p;
>+			outlen -= eword_begin_p - p;
> 			p = eword_begin_p;
> 		} else {
> 			/* ignore spaces between encoded words */
> 			for (sp = p; sp < eword_begin_p; sp++) {
> 				if (!isspace(*sp)) {
>+					if (eword_begin_p - p > outlen - 1) {
>+						strncpy2(outp, p, outlen);
>+						return;
>+					}
> 					memcpy(outp, p, eword_begin_p - p);
> 					outp += eword_begin_p - p;
>+					outlen -= eword_begin_p - p;
> 					p = eword_begin_p;
> 					break;
> 				}
>@@ -105,8 +116,13 @@ void unmime_header(gchar *out, const gch
> 				(decoded_text, text_begin_p + 1,
> 				 eword_end_p - (text_begin_p + 1));
> 		} else {
>+			if (eword_end_p + 2 - p > outlen - 1) {
>+				strncpy2(outp, p, outlen);
>+				return;
>+			}
> 			memcpy(outp, p, eword_end_p + 2 - p);
> 			outp += eword_end_p + 2 - p;
>+			outlen -= eword_end_p + 2 - p;
> 			p = eword_end_p + 2;
> 			continue;
> 		}
>@@ -115,13 +131,25 @@ void unmime_header(gchar *out, const gch
> 		conv_str = conv_codeset_strdup(decoded_text, charset, NULL);
> 		if (conv_str) {
> 			len = strlen(conv_str);
>+			if (len > outlen - 1) {
>+				strncpy2(outp, conv_str, outlen);
>+				g_free(conv_str);
>+				g_free(decoded_text);
>+				return;
>+			}
> 			memcpy(outp, conv_str, len);
> 			g_free(conv_str);
> 		} else {
> 			len = strlen(decoded_text);
>+			if (len > outlen - 1) {
>+				conv_localetodisp(outp, outlen, decoded_text);
>+				g_free(decoded_text);
>+				return;
>+			}
> 			conv_localetodisp(outp, len + 1, decoded_text);
> 		}
> 		outp += len;
>+		outlen -= len;
> 
> 		g_free(decoded_text);
> 
>diff -pru -X xcld sylpheed-0.8.10claws.orig/src/unmime.h sylpheed-0.8.10claws.sec/src/unmime.h
>--- sylpheed-0.8.10claws.orig/src/unmime.h	2002-07-11 09:44:08.000000000 +0200
>+++ sylpheed-0.8.10claws.sec/src/unmime.h	2005-03-31 10:56:32.000000000 +0200
>@@ -23,6 +23,7 @@
> #include <glib.h>
> 
> void unmime_header			(gchar		*out,
>+					 gint		 len,
> 					 const gchar	*str);
> gint unmime_quoted_printable_line	(gchar		*str);
>

Actions: View | Diff

Attachments on bug 72801: 32650 | 32677 | 32741 | 32961 | 32965 | 32969 | 32979 | 33475