If a single header is more than 200 characters long a set of 'off by
one' errors cause memory corruption.
When allocating memory with:
a = malloc (len);
the last usable byte of the memory is 'a + len - 1' rather than 'a +
len'.
Fix the same bug when calculating the current offset should the buffer
used for collecting the output header need to be reallocated.
---
gmime-filter-headers.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/gmime-filter-headers.c b/gmime-filter-headers.c
index 2f3df80..7db3779 100644
--- a/gmime-filter-headers.c
+++ b/gmime-filter-headers.c
@@ -169,7 +169,7 @@ filter_filter (GMimeFilter *filter, char *inbuf, size_t
inlen, size_t prespace,
headers->lineptr = headers->line = malloc (headers->line_size);
}
lineptr = headers->lineptr;
- lineend = headers->line + headers->line_size;
+ lineend = headers->line + headers->line_size - 1;
if (lineptr == NULL)
return;
outptr = filter->outbuf;
@@ -185,8 +185,8 @@ filter_filter (GMimeFilter *filter, char *inbuf, size_t
inlen, size_t prespace,
if (lineptr == lineend) {
headers->line_size *= 2;
headers->line = xrealloc (headers->line,
headers->line_size);
- lineptr = headers->line + headers->line_size / 2;
- lineend = headers->line + headers->line_size;
+ lineptr = headers->line + (headers->line_size / 2) - 1;
+ lineend = headers->line + headers->line_size - 1;
}
if (headers->saw_nl && *inptr != ' ' && *inptr != '\t') {
--
1.7.1
_______________________________________________
notmuch mailing list
[email protected]
http://notmuchmail.org/mailman/listinfo/notmuch
