Skip to content
Permalink
Browse files Browse the repository at this point in the history
Check types to avoid invalid reads/writes.
  • Loading branch information
EricSesterhennX41 authored and verdammelt committed Feb 23, 2017
1 parent c504468 commit 8dccf79
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 7 deletions.
4 changes: 4 additions & 0 deletions src/file.c
Expand Up @@ -173,24 +173,28 @@ file_add_mapi_attrs (File* file, MAPI_Attr** attrs)
switch (a->name)
{
case MAPI_ATTACH_LONG_FILENAME:
assert(a->type == szMAPI_STRING);
if (file->name) XFREE(file->name);
file->name = strdup( (char*)a->values[0].data.buf );
break;

case MAPI_ATTACH_DATA_OBJ:
assert((a->type == szMAPI_BINARY) || (a->type == szMAPI_OBJECT));
file->len = a->values[0].len;
if (file->data) XFREE (file->data);
file->data = CHECKED_XMALLOC (unsigned char, file->len);
memmove (file->data, a->values[0].data.buf, file->len);
break;

case MAPI_ATTACH_MIME_TAG:
assert(a->type == szMAPI_STRING);
if (file->mime_type) XFREE (file->mime_type);
file->mime_type = CHECKED_XMALLOC (char, a->values[0].len);
memmove (file->mime_type, a->values[0].data.buf, a->values[0].len);
break;

case MAPI_ATTACH_CONTENT_ID:
assert(a->type == szMAPI_STRING);
if (file->content_id) XFREE(file->content_id);
file->content_id = CHECKED_XMALLOC (char, a->values[0].len);
memmove (file->content_id, a->values[0].data.buf, a->values[0].len);
Expand Down
16 changes: 9 additions & 7 deletions src/tnef.c
Expand Up @@ -165,10 +165,12 @@ get_html_data (MAPI_Attr *a)
int j;
for (j = 0; j < a->num_values; j++)
{
body[j] = XMALLOC(VarLenData, 1);
body[j]->len = a->values[j].len;
body[j]->data = CHECKED_XCALLOC(unsigned char, a->values[j].len);
memmove (body[j]->data, a->values[j].data.buf, body[j]->len);
if (a->type == szMAPI_BINARY) {
body[j] = XMALLOC(VarLenData, 1);
body[j]->len = a->values[j].len;
body[j]->data = CHECKED_XCALLOC(unsigned char, a->values[j].len);
memmove (body[j]->data, a->values[j].data.buf, body[j]->len);
}
}
return body;
}
Expand Down Expand Up @@ -306,13 +308,13 @@ parse_file (FILE* input_file, char* directory,
for (i = 0; mapi_attrs[i]; i++)
{
MAPI_Attr *a = mapi_attrs[i];
if (a->name == MAPI_BODY_HTML)

if (a->type == szMAPI_BINARY && a->name == MAPI_BODY_HTML)
{
body.html_bodies = get_html_data (a);
html_size = a->num_values;
}
else if (a->name == MAPI_RTF_COMPRESSED)
else if (a->type == szMAPI_BINARY && a->name == MAPI_RTF_COMPRESSED)
{
body.rtf_bodies = get_rtf_data (a);
rtf_size = a->num_values;
Expand Down

0 comments on commit 8dccf79

Please sign in to comment.