pop3d_mainloop reads a line into a 512-byte stack buffer. After
the first split, pop3d_top calls pop3d_parse_command again on the
argument. If that argument has no whitespace and fills the rest
of the buffer, the scanner stops at the terminating NUL. The old
code unconditionally executed *p++ = 0 and then read *p, causing
a one-byte read past the end of the buffer.
This is reachable with a 511-byte TOP command containing only one
argument, e.g. TOP followed by 507 bytes and no second argument.
* pop3d/extra.c (pop3d_parse_command): Do not advance past the
terminating NUL.
---
pop3d/extra.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/pop3d/extra.c b/pop3d/extra.c
index e3efc907..43baf628 100644
--- a/pop3d/extra.c
+++ b/pop3d/extra.c
@@ -27,7 +27,8 @@ pop3d_parse_command (char *cmd, char **pcmd, char **parg)
cmd = mu_str_skip_class (cmd, MU_CTYPE_BLANK);
*pcmd = cmd;
p = mu_str_skip_class_comp (cmd, MU_CTYPE_SPACE);
- *p++ = 0;
+ if (*p)
+ *p++ = 0;
if (*p)
{
*parg = p;
--
2.34.1
