Bugfix
* libproto/imap/folder.c (imap_list): Fix memory overrun. Set response->level.
Showing
1 changed file
with
19 additions
and
2 deletions
... | @@ -1402,13 +1402,13 @@ imap_list (f_imap_t f_imap) | ... | @@ -1402,13 +1402,13 @@ imap_list (f_imap_t f_imap) |
1402 | if (f_imap->enum_stop) | 1402 | if (f_imap->enum_stop) |
1403 | return 0; | 1403 | return 0; |
1404 | 1404 | ||
1405 | buffer = malloc (len); | 1405 | buffer = malloc (len + 1); |
1406 | if (!buffer) | 1406 | if (!buffer) |
1407 | return ENOMEM; | 1407 | return ENOMEM; |
1408 | memcpy (buffer, f_imap->buffer, len); | 1408 | memcpy (buffer, f_imap->buffer, len); |
1409 | buffer[len] = '\0'; | 1409 | buffer[len] = '\0'; |
1410 | 1410 | ||
1411 | lr = malloc (sizeof (*lr)); | 1411 | lr = calloc (1, sizeof (*lr)); |
1412 | if (!lr) | 1412 | if (!lr) |
1413 | return ENOMEM; | 1413 | return ENOMEM; |
1414 | 1414 | ||
... | @@ -1488,6 +1488,23 @@ imap_list (f_imap_t f_imap) | ... | @@ -1488,6 +1488,23 @@ imap_list (f_imap_t f_imap) |
1488 | if (!lr->name) | 1488 | if (!lr->name) |
1489 | status = ENOMEM; | 1489 | status = ENOMEM; |
1490 | } | 1490 | } |
1491 | if (lr->separator) | ||
1492 | { | ||
1493 | size_t off; | ||
1494 | char delim[2]; | ||
1495 | size_t n = 0; | ||
1496 | |||
1497 | delim[0] = lr->separator; | ||
1498 | delim[1] = 0; | ||
1499 | s = lr->name; | ||
1500 | while (off = strcspn (s, delim), s[off]) | ||
1501 | { | ||
1502 | n++; | ||
1503 | off++; | ||
1504 | s += off; | ||
1505 | } | ||
1506 | lr->level = n; | ||
1507 | } | ||
1491 | } | 1508 | } |
1492 | mu_argcv_free (argc, argv); | 1509 | mu_argcv_free (argc, argv); |
1493 | free (buffer); | 1510 | free (buffer); | ... | ... |
-
Please register or sign in to post a comment