Commit a4b7febb a4b7febbcb907b96181361824fac23e24485c023 by Sergey Poznyakoff

Fix possible output buffer overflow in base64 encoder.

* libmailutils/filter/base64.c (_base64_encoder): Continue after
incrementing nbytes.
* mh/mhn.c: Additional error checking.
1 parent 89669008
...@@ -267,12 +267,14 @@ _base64_encoder (void *xd, ...@@ -267,12 +267,14 @@ _base64_encoder (void *xd,
267 { 267 {
268 case base64_init: 268 case base64_init:
269 break; 269 break;
270
270 case base64_newline: 271 case base64_newline:
271 *optr++ = '\n'; 272 *optr++ = '\n';
272 nbytes++; 273 nbytes++;
273 lp->cur_len = 0; 274 lp->cur_len = 0;
274 lp->state = base64_rollback; 275 lp->state = base64_rollback;
275 /* Fall through */ 276 continue;
277
276 case base64_rollback: 278 case base64_rollback:
277 if (lp->idx < 3) 279 if (lp->idx < 3)
278 { 280 {
......
...@@ -2187,9 +2187,14 @@ finish_text_msg (struct compose_env *env, mu_message_t *msg, int ascii) ...@@ -2187,9 +2187,14 @@ finish_text_msg (struct compose_env *env, mu_message_t *msg, int ascii)
2187 MU_STREAM_READ); 2187 MU_STREAM_READ);
2188 if (rc == 0) 2188 if (rc == 0)
2189 { 2189 {
2190 mu_stream_copy (output, fstr, 0, NULL); 2190 rc = mu_stream_copy (output, fstr, 0, NULL);
2191 mu_stream_destroy (&fstr); 2191 mu_stream_destroy (&fstr);
2192 mu_message_unref (*msg); 2192 mu_message_unref (*msg);
2193 if (rc)
2194 {
2195 mu_diag_funcall (MU_DIAG_ERROR, "mu_stream_copy", NULL, rc);
2196 exit (1);
2197 }
2193 *msg = newmsg; 2198 *msg = newmsg;
2194 } 2199 }
2195 else 2200 else
...@@ -2533,8 +2538,13 @@ edit_mime (char *cmd, struct compose_env *env, mu_message_t *msg, int level) ...@@ -2533,8 +2538,13 @@ edit_mime (char *cmd, struct compose_env *env, mu_message_t *msg, int level)
2533 2538
2534 mu_message_get_body (*msg, &body); 2539 mu_message_get_body (*msg, &body);
2535 mu_body_get_streamref (body, &out); 2540 mu_body_get_streamref (body, &out);
2536 mu_stream_copy (out, fstr, 0, NULL); 2541 rc = mu_stream_copy (out, fstr, 0, NULL);
2537 2542 if (rc)
2543 {
2544 mu_diag_funcall (MU_DIAG_ERROR, "mu_stream_copy", NULL, rc);
2545 exit (1);
2546 }
2547
2538 mu_stream_close (out); 2548 mu_stream_close (out);
2539 mu_stream_destroy (&out); 2549 mu_stream_destroy (&out);
2540 mu_stream_destroy (&fstr); 2550 mu_stream_destroy (&fstr);
......