Fix possible output buffer overflow in base64 encoder.
* libmailutils/filter/base64.c (_base64_encoder): Continue after incrementing nbytes. * mh/mhn.c: Additional error checking.
Showing
2 changed files
with
16 additions
and
4 deletions
... | @@ -267,12 +267,14 @@ _base64_encoder (void *xd, | ... | @@ -267,12 +267,14 @@ _base64_encoder (void *xd, |
267 | { | 267 | { |
268 | case base64_init: | 268 | case base64_init: |
269 | break; | 269 | break; |
270 | |||
270 | case base64_newline: | 271 | case base64_newline: |
271 | *optr++ = '\n'; | 272 | *optr++ = '\n'; |
272 | nbytes++; | 273 | nbytes++; |
273 | lp->cur_len = 0; | 274 | lp->cur_len = 0; |
274 | lp->state = base64_rollback; | 275 | lp->state = base64_rollback; |
275 | /* Fall through */ | 276 | continue; |
277 | |||
276 | case base64_rollback: | 278 | case base64_rollback: |
277 | if (lp->idx < 3) | 279 | if (lp->idx < 3) |
278 | { | 280 | { | ... | ... |
... | @@ -2187,9 +2187,14 @@ finish_text_msg (struct compose_env *env, mu_message_t *msg, int ascii) | ... | @@ -2187,9 +2187,14 @@ finish_text_msg (struct compose_env *env, mu_message_t *msg, int ascii) |
2187 | MU_STREAM_READ); | 2187 | MU_STREAM_READ); |
2188 | if (rc == 0) | 2188 | if (rc == 0) |
2189 | { | 2189 | { |
2190 | mu_stream_copy (output, fstr, 0, NULL); | 2190 | rc = mu_stream_copy (output, fstr, 0, NULL); |
2191 | mu_stream_destroy (&fstr); | 2191 | mu_stream_destroy (&fstr); |
2192 | mu_message_unref (*msg); | 2192 | mu_message_unref (*msg); |
2193 | if (rc) | ||
2194 | { | ||
2195 | mu_diag_funcall (MU_DIAG_ERROR, "mu_stream_copy", NULL, rc); | ||
2196 | exit (1); | ||
2197 | } | ||
2193 | *msg = newmsg; | 2198 | *msg = newmsg; |
2194 | } | 2199 | } |
2195 | else | 2200 | else |
... | @@ -2533,8 +2538,13 @@ edit_mime (char *cmd, struct compose_env *env, mu_message_t *msg, int level) | ... | @@ -2533,8 +2538,13 @@ edit_mime (char *cmd, struct compose_env *env, mu_message_t *msg, int level) |
2533 | 2538 | ||
2534 | mu_message_get_body (*msg, &body); | 2539 | mu_message_get_body (*msg, &body); |
2535 | mu_body_get_streamref (body, &out); | 2540 | mu_body_get_streamref (body, &out); |
2536 | mu_stream_copy (out, fstr, 0, NULL); | 2541 | rc = mu_stream_copy (out, fstr, 0, NULL); |
2537 | 2542 | if (rc) | |
2543 | { | ||
2544 | mu_diag_funcall (MU_DIAG_ERROR, "mu_stream_copy", NULL, rc); | ||
2545 | exit (1); | ||
2546 | } | ||
2547 | |||
2538 | mu_stream_close (out); | 2548 | mu_stream_close (out); |
2539 | mu_stream_destroy (&out); | 2549 | mu_stream_destroy (&out); |
2540 | mu_stream_destroy (&fstr); | 2550 | mu_stream_destroy (&fstr); | ... | ... |
-
Please register or sign in to post a comment