Bugzilla – Attachment 64518 Details for
Bug 142490
VUL-0: bogofilter heap overflow
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
IDP Log In
|
Forgot Password
[patch]
Patch for version 0.96.2
bogofilter-0.96.2-0.96.3.diff (text/plain), 16.34 KB, created by
Lars Müller
on 2006-01-23 15:18:25 UTC
(
hide
)
Description:
Patch for version 0.96.2
Filename:
MIME Type:
Creator:
Lars Müller
Created:
2006-01-23 15:18:25 UTC
Size:
16.34 KB
patch
obsolete
>diff -urN bogofilter-0.96.2/src/bogoconfig.c bogofilter-0.96.3/src/bogoconfig.c >--- bogofilter-0.96.2/src/bogoconfig.c 2005-06-29 13:12:09.000000000 +0200 >+++ bogofilter-0.96.3/src/bogoconfig.c 2005-10-15 22:52:51.000000000 +0200 >@@ -1,4 +1,4 @@ >-/* $Id: bogoconfig.c,v 1.230 2005/06/29 10:05:22 m-a Exp $ */ >+/* $Id: bogoconfig.c,v 1.232 2005/10/15 20:52:51 relson Exp $ */ > > /***************************************************************************** > >@@ -47,7 +47,6 @@ > #include "bogoreader.h" > #include "bool.h" > #include "charset.h" >-#include "configfile.h" > #include "datastore.h" > #include "datastore_db.h" > #include "error.h" >@@ -715,7 +714,10 @@ > #ifndef DISABLE_TRANSACTIONS > if (!dsm_options_bogofilter(option, name, val)) > #endif >- abort(); >+ { >+ fprintf(stderr, "Invalid option '%s'.\n", name); >+ exit(EX_ERROR); >+ } > } > } > >diff -urN bogofilter-0.96.2/src/bogoconfig.h bogofilter-0.96.3/src/bogoconfig.h >--- bogofilter-0.96.2/src/bogoconfig.h 2005-02-09 05:39:55.000000000 +0100 >+++ bogofilter-0.96.3/src/bogoconfig.h 2005-10-15 22:52:51.000000000 +0200 >@@ -1,4 +1,4 @@ >-/* $Id: bogoconfig.h,v 1.22 2005/01/06 14:46:24 m-a Exp $ */ >+/* $Id: bogoconfig.h,v 1.23 2005/10/15 20:52:51 relson Exp $ */ > > /***************************************************************************** > >@@ -14,7 +14,6 @@ > #define BOGOCONFIG_H > > #include "configfile.h" >-#include "getopt.h" /* for struct option */ > > /* Global variables */ > >diff -urN bogofilter-0.96.2/src/collect.c bogofilter-0.96.3/src/collect.c >--- bogofilter-0.96.2/src/collect.c 2005-06-14 01:19:50.000000000 +0200 >+++ bogofilter-0.96.3/src/collect.c 2005-10-26 02:27:43.000000000 +0200 >@@ -1,4 +1,4 @@ >-/* $Id: collect.c,v 1.45 2005/03/13 16:38:13 relson Exp $ */ >+/* $Id: collect.c,v 1.46 2005/10/26 00:27:43 relson Exp $ */ > > /* collect.c -- tokenize input and cap word frequencies, return a wordhash */ > >@@ -14,8 +14,6 @@ > > #include "collect.h" > >-void mime_type2(word_t * text); >- > void wordprop_init(void *vwordprop) > { > wordprop_t *wp = vwordprop; >@@ -88,29 +86,6 @@ > } > #endif > >-#ifdef CP866_XXX >-/* breaks "make check", specifically t.grftest and t.bulkmode -- DR 01/02/05 */ >-/* EK binary problem hack */ >- if (token->leng > 8) >- { >- char str[80]; >- static int binflag=0; >- int l; >- l = token->leng; >- if (l > 40) l = 40; >- strncpy(str,token->text,l); >- str[l] = 0; >- if (!strncasecmp(str, "Content-Type", 12)) >- { >- binflag++; >- } else if (binflag == 1) { >- mime_type2(token); >- binflag++; >- } else >- binflag = 0; >- } >-#endif >- > /******* end of EK addition **********/ > > if (DEBUG_WORDLIST(3)) { >diff -urN bogofilter-0.96.2/src/configfile.c bogofilter-0.96.3/src/configfile.c >--- bogofilter-0.96.2/src/configfile.c 2005-06-17 05:28:15.000000000 +0200 >+++ bogofilter-0.96.3/src/configfile.c 2005-10-15 23:03:11.000000000 +0200 >@@ -1,4 +1,4 @@ >-/* $Id: configfile.c,v 1.51 2005/03/29 03:04:39 relson Exp $ */ >+/* $Id: configfile.c,v 1.52 2005/10/15 21:03:11 relson Exp $ */ > > /***************************************************************************** > >@@ -80,24 +80,29 @@ > bool ok = true; > > char *val = NULL; >- char *opt = xstrdup(arg); >+ const char *opt = arg; >+ char *dup; > const char delim[] = " \t="; > >- pos = strcspn(arg, delim); >- if (pos < strlen(arg)) { /* if delimiter present */ >- val = opt + pos; >+ while (isspace(*opt)) /* ignore leadign whitespace */ >+ opt += 1; >+ >+ dup = xstrdup(opt); >+ pos = strcspn(dup, delim); >+ if (pos < strlen(dup)) { /* if delimiter present */ >+ val = dup + pos; > *val++ = '\0'; > val += strspn(val, delim); > } > > if (val == NULL || >- !process_config_option_as_arg(opt, val, precedence, longopts)) { >+ !process_config_option_as_arg(dup, val, precedence, longopts)) { > ok = false; > if (warn_on_error) > fprintf(stderr, "Error - bad parameter '%s'\n", arg); > } > >- xfree(opt); >+ xfree(dup); > return ok; > } > >diff -urN bogofilter-0.96.2/src/iconvert.c bogofilter-0.96.3/src/iconvert.c >--- bogofilter-0.96.2/src/iconvert.c 2005-08-28 23:46:14.000000000 +0200 >+++ bogofilter-0.96.3/src/iconvert.c 2005-10-23 17:09:52.000000000 +0200 >@@ -1,4 +1,4 @@ >-/* $Id: iconvert.c,v 1.12 2005/06/25 23:23:35 relson Exp $ */ >+/* $Id: iconvert.c,v 1.15 2005/10/23 15:09:52 relson Exp $ */ > > /***************************************************************************** > >@@ -53,8 +53,8 @@ > break; > } > if (msg != NULL) >- fprintf(dbgout, "e: %d, %s - t: %p, r: %d, l: %d, s: %d\n", >- err, msg, src->t.text, src->read, src->t.leng, src->size); >+ fprintf(dbgout, "err: %s (%d), tx: %p, rd: %d, ln: %d, sz: %d\n", >+ msg, err, src->t.text, src->read, src->t.leng, src->size); > } > } > >@@ -151,9 +151,8 @@ > break; > > case E2BIG: /* output buffer has no more room */ >+ /* TODO: Provide proper handling of E2BIG */ > done = true; >- if (DEBUG_ICONV(1)) /* TODO: Provide proper handling of E2BIG */ >- fprintf(dbgout, "E2BIG\n"); > break; > > default: >@@ -165,13 +164,16 @@ > > if (src->read >= src->t.leng) > done = true; >+ >+ if (outbytesleft == 0) >+ done = true; > } > > Z(dst->t.text[dst->t.leng]); /* for easier debugging - removable */ > > if (DEBUG_ICONV(1) && > src->t.leng != src->read) >- fprintf(dbgout, "t: %p, r: %d, l: %d, s: %d\n", >+ fprintf(dbgout, "tx: %p, rd: %d, ln: %d, sz: %d\n", > src->t.text, src->read, src->t.leng, src->size); > } > >diff -urN bogofilter-0.96.2/src/lexer.c bogofilter-0.96.3/src/lexer.c >--- bogofilter-0.96.2/src/lexer.c 2005-09-08 04:53:40.000000000 +0200 >+++ bogofilter-0.96.3/src/lexer.c 2005-10-25 13:10:39.000000000 +0200 >@@ -1,4 +1,4 @@ >-/* $Id: lexer.c,v 1.141 2005/09/08 02:53:40 relson Exp $ */ >+/* $Id: lexer.c,v 1.143 2005/10/23 15:15:55 relson Exp $ */ > > /** > * \file lexer.c >@@ -90,6 +90,11 @@ > uint i; > for (i=0; i < count; i += 1) { > byte c = buf[i]; >+ /* 10/23/05 - fix SIGSEGV with msg.1023.6479.txt >+ ** evidently caused by 09/07/05 patch for 0.96.2 >+ */ >+ if (c == '\0') >+ break; > if ((iscntrl(c) || isspace(c) || ispunct(c)) && (c != '_')) > return false; > } >@@ -151,7 +156,8 @@ > uint used = buff->t.leng; > byte *buf = buff->t.text + used; > >- if (encoding == E_RAW) { >+ if (encoding == E_RAW || >+ msg_state->mime_dont_decode ) { > temp = buff; > } > #ifndef DISABLE_UNICODE >@@ -191,7 +197,9 @@ > if (passthrough && passmode == PASS_MEM && count > 0) > textblock_add(temp->t.text+temp->read, (size_t) count); > >- if ( !msg_header && msg_state->mime_type != MIME_TYPE_UNKNOWN) >+ if ( !msg_header && >+ !msg_state->mime_dont_decode && >+ msg_state->mime_type != MIME_TYPE_UNKNOWN) > { > word_t line; > uint decoded_count; >@@ -210,7 +218,9 @@ > } > > #ifndef DISABLE_UNICODE >- if (encoding == E_UNICODE) { >+ if (encoding == E_UNICODE && >+ !msg_state->mime_dont_decode) >+ { > iconvert(temp, buff); > /* > * iconvert, treating multi-byte sequences, can shrink or enlarge >@@ -329,9 +339,8 @@ > } > > if (msg_state && >- msg_state->mime_disposition && >- (msg_state->mime_type == MIME_APPLICATION || >- msg_state->mime_type == MIME_IMAGE)) { >+ msg_state->mime_dont_decode && >+ (msg_state->mime_disposition != MIME_DISPOSITION_UNKNOWN)) { > return (count == EOF ? 0 : count); /* not decode at all */ > } > >diff -urN bogofilter-0.96.2/src/longoptions.h bogofilter-0.96.3/src/longoptions.h >--- bogofilter-0.96.2/src/longoptions.h 2005-06-21 01:30:56.000000000 +0200 >+++ bogofilter-0.96.3/src/longoptions.h 2005-10-15 23:02:44.000000000 +0200 >@@ -1,4 +1,4 @@ >-/* $Id: longoptions.h,v 1.18 2005/06/18 16:36:09 relson Exp $ */ >+/* $Id: longoptions.h,v 1.19 2005/10/15 21:02:44 relson Exp $ */ > > /***************************************************************************** > >@@ -28,8 +28,6 @@ > O_BLOCK_ON_SUBNETS = 1000, > O_CHARSET_DEFAULT, > O_CONFIG_FILE, >- O_DB_MAX_OBJECTS, >- O_DB_MAX_LOCKS, > O_DB_CHECKPOINT, > O_DB_LIST_LOGFILES, > O_DB_PRINT_LEAFPAGE_COUNT, >@@ -102,8 +100,6 @@ > #ifdef HAVE_DECL_DB_CREATE > #undef lo1 > #define lo1 \ >- { "db-lk-max-locks", R, 0, O_DB_MAX_LOCKS }, \ >- { "db-lk-max-objects", R, 0, O_DB_MAX_OBJECTS }, \ > { "db-log-autoremove", R, 0, O_DB_LOG_AUTOREMOVE }, > #ifdef FUTURE_DB_OPTIONS > #undef lo2 >diff -urN bogofilter-0.96.2/src/mime.c bogofilter-0.96.3/src/mime.c >--- bogofilter-0.96.2/src/mime.c 2005-09-06 04:04:23.000000000 +0200 >+++ bogofilter-0.96.3/src/mime.c 2005-10-26 02:27:43.000000000 +0200 >@@ -1,4 +1,4 @@ >-/* $Id: mime.c,v 1.47 2005/09/06 02:04:23 relson Exp $ */ >+/* $Id: mime.c,v 1.55 2005/10/26 00:27:43 relson Exp $ */ > > /** > * \file mime.c >@@ -42,13 +42,15 @@ > const char *name; /**< prefix of MIME type to match */ > size_t len; /**< length of \a name */ > } mime_type_table[] = { >- { MIME_TEXT_HTML, "text/html", 9 }, >- { MIME_TEXT_PLAIN, "text/plain", 10 }, >- { MIME_TEXT, "text", 4 }, /* NON-COMPLIANT; should be "text/" */ >- { MIME_APPLICATION, "application/", 12 }, >- { MIME_IMAGE, "image/", 6 }, >- { MIME_MESSAGE, "message/", 8 }, >- { MIME_MULTIPART, "multipart/", 10 }, >+ { MIME_TEXT_HTML, "text/html", 9 }, >+ { MIME_TEXT_PLAIN, "text/plain", 10 }, >+ { MIME_TEXT, "text", 4 }, /* NON-COMPLIANT; should be "text/" */ >+ { MIME_APPLICATION, "application/", 12 }, >+ { MIME_MESSAGE, "message/", 8 }, >+ { MIME_MULTIPART, "multipart/", 10 }, >+ { MIME_IMAGE, "image/bmp", 9 }, >+ { MIME_AUDIO, "audio/", 6 }, >+ { MIME_VIDEO, "video/", 6 }, > }; > > /** MIME encodings that we detect. */ >@@ -56,12 +58,12 @@ > enum mimeencoding encoding; /**< internal representation of encoding */ > const char *name; /**< encoding name to match */ > } mime_encoding_table[] = { >- { MIME_7BIT, "7BIT" }, >- { MIME_8BIT, "8BIT" }, >- { MIME_BINARY, "BINARY" }, >- { MIME_QP, "QUOTED-PRINTABLE" }, >- { MIME_BASE64, "BASE64" }, >- { MIME_UUENCODE, "X-UUENCODE" }, >+ { MIME_7BIT, "7BIT" }, >+ { MIME_8BIT, "8BIT" }, >+ { MIME_BINARY, "BINARY" }, >+ { MIME_QP, "QUOTED-PRINTABLE" }, >+ { MIME_BASE64, "BASE64" }, >+ { MIME_UUENCODE, "X-UUENCODE" }, > }; > > /** MIME content dispositions that we detect. */ >@@ -69,8 +71,8 @@ > enum mimedisposition disposition; /**< internal representation of disposition */ > const char *name; /**< disposition name to match */ > } mime_disposition_table[] = { >- { MIME_INLINE, "inline" }, >- { MIME_ATTACHMENT, "attachment" }, >+ { MIME_INLINE, "inline" }, >+ { MIME_ATTACHMENT, "attachment" }, > }; > > /** properties of a MIME boundary */ >@@ -104,44 +106,33 @@ > } > #endif > >-static const char *str_mime_type(enum mimetype m) { >+static const char *str_mime_type(enum mimetype m) >+{ > switch (m) { >- case MIME_TYPE_UNKNOWN: >- return "unknown"; >- case MIME_MULTIPART: >- return "multipart/*"; >- case MIME_MESSAGE: >- return "message/*"; >- case MIME_TEXT: >- return "text/*"; >- case MIME_TEXT_PLAIN: >- return "text/plain"; >- case MIME_TEXT_HTML: >- return "text/html"; >- case MIME_APPLICATION: >- return "application/*"; >- case MIME_IMAGE: >- return "image/*"; >- } >+ case MIME_TYPE_UNKNOWN: return "unknown"; >+ case MIME_MULTIPART: return "multipart/*"; >+ case MIME_MESSAGE: return "message/*"; >+ case MIME_TEXT: return "text/*"; >+ case MIME_TEXT_PLAIN: return "text/plain"; >+ case MIME_TEXT_HTML: return "text/html"; >+ case MIME_APPLICATION: return "application/*"; >+ case MIME_IMAGE: return "image/*"; >+ case MIME_AUDIO: return "audio/*"; >+ case MIME_VIDEO: return "video/*"; >+} > return "INTERNAL_ERROR"; > } > >-static const char *str_mime_enc(enum mimeencoding e) { >+static const char *str_mime_enc(enum mimeencoding e) >+{ > switch (e) { >- case MIME_ENCODING_UNKNOWN: >- return "unknown"; >- case MIME_7BIT: >- return "7bit"; >- case MIME_8BIT: >- return "8bit"; >- case MIME_BINARY: >- return "binary"; >- case MIME_QP: >- return "quoted-printable"; >- case MIME_BASE64: >- return "base64"; >- case MIME_UUENCODE: >- return "x-uuencode"; >+ case MIME_ENCODING_UNKNOWN: return "unknown"; >+ case MIME_7BIT: return "7bit"; >+ case MIME_8BIT: return "8bit"; >+ case MIME_BINARY: return "binary"; >+ case MIME_QP: return "quoted-printable"; >+ case MIME_BASE64: return "base64"; >+ case MIME_UUENCODE: return "x-uuencode"; > } > return "INTERNAL_ERROR"; > } >@@ -155,12 +146,12 @@ > > for (ptr = mime_stack_top; ptr != NULL; ptr = ptr->child) > { >- fprintf(dbgout, "**** %3d type %s enc %s bnd %s chr %s\n", >+ fprintf(dbgout, "**** %3d type: %-16s enc: %-16s chr: %-8.8s bnd: %s\n", > ptr->depth, > str_mime_type(ptr->mime_type), > str_mime_enc(ptr->mime_encoding), >- ptr->boundary ? ptr->boundary : "NIL", >- ptr->charset); >+ ptr->charset, >+ ptr->boundary ? ptr->boundary : "NIL"); > } > } > #endif >@@ -175,8 +166,11 @@ > msg_state->charset = xstrdup("US-ASCII"); > msg_state->depth = (parent == NULL) ? 0 : msg_state->parent->depth + 1; > msg_state->child = NULL; >+ msg_state->mime_dont_decode = false; >+ > if (parent) > parent->child = msg_state; >+ > return; > } > >@@ -188,6 +182,9 @@ > if (mime_stack_bot == t) > mime_stack_bot = t->parent; > >+ if (mime_stack_top == t) >+ mime_stack_top = NULL; >+ > if (t->boundary) { > xfree(t->boundary); > t->boundary = NULL; >@@ -221,9 +218,8 @@ > { > msg_state = (mime_t *) xmalloc(sizeof(mime_t)); > >- if (parent == NULL) { >+ if (parent == NULL) > mime_stack_top = msg_state; >- } > > mime_stack_bot = msg_state; > >@@ -458,10 +454,13 @@ > break; > } > } >+ > if (DEBUG_MIME(0) > && msg_state->mime_disposition == MIME_DISPOSITION_UNKNOWN) > fprintf(stderr, "Unknown mime disposition - '%s'\n", w); >+ > xfree(w); >+ > return; > } > >@@ -496,10 +495,13 @@ > break; > } > } >+ > if (DEBUG_MIME(0) > && msg_state->mime_encoding == MIME_ENCODING_UNKNOWN) > fprintf(stderr, "Unknown mime encoding - '%s'\n", w); >+ > xfree(w); >+ > return; > } > >@@ -527,69 +529,18 @@ > xfree(w); > > switch (msg_state->mime_type) { >- case MIME_TEXT: >- case MIME_TEXT_PLAIN: >- /* XXX: read charset */ >- case MIME_TEXT_HTML: >- return; >- case MIME_TYPE_UNKNOWN: >- return; >- case MIME_MULTIPART: >- /* XXX: read boundary */ >- return; >- case MIME_MESSAGE: >- return; >+ case MIME_TEXT: return; /* XXX: read charset */ >+ case MIME_TEXT_PLAIN: return; /* XXX: read charset */ >+ case MIME_TEXT_HTML: return; >+ case MIME_TYPE_UNKNOWN: return; >+ case MIME_MULTIPART: return; /* XXX: read boundary */ >+ case MIME_MESSAGE: return; > case MIME_APPLICATION: >- return; > case MIME_IMAGE: >- return; >+ case MIME_AUDIO: >+ case MIME_VIDEO: msg_state->mime_dont_decode = true; return; > } >- return; >-} >- >-/* to be removed. Used only by bogus hacks in collect.c::collect_words */ >-void mime_type2(word_t * text) >-{ >- byte *w = text->text; >- struct type_s *typ; > >- if (!w) >- return; >- >- msg_state->mime_type = MIME_TYPE_UNKNOWN; >- for (typ = mime_type_table; >- typ < mime_type_table + COUNTOF(mime_type_table); typ += 1) { >- if (strncasecmp((const char *)w, typ->name, typ->len) == 0) { >- msg_state->mime_type = typ->type; >- if (DEBUG_MIME(1) || DEBUG_LEXER(1)) >- fprintf(dbgout, "*** mime_type: %s\n", text->text); >- break; >- } >- } >- if (DEBUG_MIME(0) && msg_state->mime_type == MIME_TYPE_UNKNOWN) >- fprintf(stderr, "Unknown mime type - '%s'\n", w); >-#if 0 >- switch (msg_state->mime_type) { >- case MIME_TEXT: >- case MIME_TEXT_HTML: >- case MIME_TEXT_PLAIN: >- /* XXX: read charset */ >- return; >- case MIME_TYPE_UNKNOWN: >- return; >- case MIME_MULTIPART: >- return; >- case MIME_MESSAGE: >- /* XXX: read boundary */ >- return; >- case MIME_APPLICATION: >- /* XXX: read boundary */ >- return; >- case MIME_IMAGE: >- /* XXX: read boundary */ >- return; >- } >-#endif > return; > } > >diff -urN bogofilter-0.96.2/src/mime.h bogofilter-0.96.3/src/mime.h >--- bogofilter-0.96.2/src/mime.h 2005-09-06 04:01:22.000000000 +0200 >+++ bogofilter-0.96.3/src/mime.h 2005-10-26 01:48:03.000000000 +0200 >@@ -1,4 +1,4 @@ >-/* $Id: mime.h,v 1.24 2005/09/06 02:01:22 relson Exp $ */ >+/* $Id: mime.h,v 1.26 2005/10/25 23:48:03 relson Exp $ */ > > /** \file mime.h > * prototypes and definitions for mime.c >@@ -18,7 +18,9 @@ > MIME_TEXT_PLAIN, > MIME_TEXT_HTML, > MIME_APPLICATION, >- MIME_IMAGE >+ MIME_IMAGE, >+ MIME_AUDIO, >+ MIME_VIDEO > }; > > enum mimeencoding { >@@ -47,6 +49,7 @@ > MIME_MULTIPART or MIME_MESSAGE */ > size_t boundary_len; > enum mimetype mime_type; >+ bool mime_dont_decode; > enum mimeencoding mime_encoding; > enum mimedisposition mime_disposition; > mime_t *parent;
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
Actions:
View
|
Diff
Attachments on
bug 142490
: 64518