diff options
author | Kevin McCarthy <kevin@8t8.us> | 2022-04-05 11:05:52 -0700 |
---|---|---|
committer | Kevin McCarthy <kevin@8t8.us> | 2022-04-05 11:20:23 -0700 |
commit | e5ed080c00e59701ca62ef9b2a6d2612ebf765a5 (patch) | |
tree | 8c6097ff5c55b16816f687b81f8971df95defaf5 /handler.c | |
parent | aa28abe8fa809427f2d8967f2c3f5a49c174a50d (diff) |
Fix uudecode buffer overflow.
mutt_decode_uuencoded() used each line's initial "length character"
without any validation. It would happily read past the end of the
input line, and with a suitable value even past the length of the
input buffer.
As I noted in ticket 404, there are several other changes that could
be added to make the parser more robust. However, to avoid
accidentally introducing another bug or regression, I'm restricting
this patch to simply addressing the overflow.
Thanks to Tavis Ormandy for reporting the issue, along with a sample
message demonstrating the problem.
Diffstat (limited to 'handler.c')
-rw-r--r-- | handler.c | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -404,9 +404,9 @@ static void mutt_decode_uuencoded (STATE *s, LOFF_T len, int istext, iconv_t cd) pt = tmps; linelen = decode_byte (*pt); pt++; - for (c = 0; c < linelen;) + for (c = 0; c < linelen && *pt;) { - for (l = 2; l <= 6; l += 2) + for (l = 2; l <= 6 && *pt && *(pt + 1); l += 2) { out = decode_byte (*pt) << l; pt++; |