RFC 3501 allows an empty LIST reference name. list_ref stores
strlen(ref) in refinfo.reflen and then reads ref[refinfo.reflen-1]
to decide whether to insert a hierarchy delimiter. When ref is
empty, refinfo.reflen is zero and this reads one byte before the
allocated buffer.
* imap4d/list.c (list_ref): Check refinfo.reflen > 0 before indexing
the last character of the reference.
---
imap4d/list.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/imap4d/list.c b/imap4d/list.c
index 92778163..2927cf55 100644
--- a/imap4d/list.c
+++ b/imap4d/list.c
@@ -211,7 +211,9 @@ list_ref (char const *ref, char const *wcard, char const
*cwd,
/* Insert delimiter after the reference prefix, unless the latter already
ends with a delimiter or is the same as the namespace prefix. */
- if (ref[refinfo.reflen-1] != pfx->delim && strcmp (ref, pfx->prefix))
+ if (refinfo.reflen > 0
+ && ref[refinfo.reflen-1] != pfx->delim
+ && strcmp (ref, pfx->prefix))
refinfo.delim = pfx->delim;
/* The special name INBOX is included in the output from LIST, if
--
2.34.1
