Commit 5969fca5 5969fca5b35d8ba4a3f88e2d1a25cd4e9c985a7e by Sergey Poznyakoff

Bugfix

* libproto/imap/folder.c (imap_list): Fix memory overrun.
Set response->level.
1 parent 4616b75f
...@@ -1402,13 +1402,13 @@ imap_list (f_imap_t f_imap) ...@@ -1402,13 +1402,13 @@ imap_list (f_imap_t f_imap)
1402 if (f_imap->enum_stop) 1402 if (f_imap->enum_stop)
1403 return 0; 1403 return 0;
1404 1404
1405 buffer = malloc (len); 1405 buffer = malloc (len + 1);
1406 if (!buffer) 1406 if (!buffer)
1407 return ENOMEM; 1407 return ENOMEM;
1408 memcpy (buffer, f_imap->buffer, len); 1408 memcpy (buffer, f_imap->buffer, len);
1409 buffer[len] = '\0'; 1409 buffer[len] = '\0';
1410 1410
1411 lr = malloc (sizeof (*lr)); 1411 lr = calloc (1, sizeof (*lr));
1412 if (!lr) 1412 if (!lr)
1413 return ENOMEM; 1413 return ENOMEM;
1414 1414
...@@ -1488,6 +1488,23 @@ imap_list (f_imap_t f_imap) ...@@ -1488,6 +1488,23 @@ imap_list (f_imap_t f_imap)
1488 if (!lr->name) 1488 if (!lr->name)
1489 status = ENOMEM; 1489 status = ENOMEM;
1490 } 1490 }
1491 if (lr->separator)
1492 {
1493 size_t off;
1494 char delim[2];
1495 size_t n = 0;
1496
1497 delim[0] = lr->separator;
1498 delim[1] = 0;
1499 s = lr->name;
1500 while (off = strcspn (s, delim), s[off])
1501 {
1502 n++;
1503 off++;
1504 s += off;
1505 }
1506 lr->level = n;
1507 }
1491 } 1508 }
1492 mu_argcv_free (argc, argv); 1509 mu_argcv_free (argc, argv);
1493 free (buffer); 1510 free (buffer);
......