Skip to content

Commit

Permalink
lib-sieve: util: rfc2822: Fix assert panic occurring in rfc2822_heade…
Browse files Browse the repository at this point in the history
…r_append().

Panic was: "Buffer write out of range"

With some rather weird (sender-provided!) input, the header folding algorithm
got confused, causing a pointer to the start of the current line to exceed the
parsing pointer. This caused str_append_data() to be called with a negative
size. Added an assertion to make any future similar problems more obvious.
  • Loading branch information
stephanbosch authored and villesavolainen committed Sep 10, 2018
1 parent 8647d31 commit ed170e1
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions src/lib-sieve/util/rfc2822.c
Expand Up @@ -180,6 +180,7 @@ unsigned int rfc2822_header_append
sp = bp;
} else {
/* Insert newline at last whitespace within the max_line limit */
i_assert(wp >= sp);
str_append_data(header, sp, wp-sp);

/* Force continued line; drop any existing whitespace */
Expand All @@ -195,6 +196,8 @@ unsigned int rfc2822_header_append
str_append_c(header, '\t');

sp = wp;
if (sp > bp)
bp = sp;
}

lines++;
Expand Down

0 comments on commit ed170e1

Please sign in to comment.