dovecot-2.2: imap: harden read_uoff_t() against overflow
dovecot at dovecot.org
dovecot at dovecot.org
Wed Jul 2 15:23:26 UTC 2014
details: http://hg.dovecot.org/dovecot-2.2/rev/9b9b6dc7dd9b
changeset: 17557:9b9b6dc7dd9b
user: Phil Carmody <phil at dovecot.fi>
date: Wed Jul 02 18:21:24 2014 +0300
description:
imap: harden read_uoff_t() against overflow
Invalid strings like "20496382304121724029" (2^64*10/9) can be parsed
as valid. Use the new helper.
Change in error behaviour - previously overflows, if they were detected,
caused *p to point to the digit causing the overflow. Now it's undefined.
Current clients don't care about this difference, they just bail.
Signed-off-by: Phil Carmody <phil at dovecot.fi>
diffstat:
src/imap/imap-fetch-body.c | 14 +-------------
1 files changed, 1 insertions(+), 13 deletions(-)
diffs (24 lines):
diff -r dfc55d17314a -r 9b9b6dc7dd9b src/imap/imap-fetch-body.c
--- a/src/imap/imap-fetch-body.c Wed Jul 02 18:21:24 2014 +0300
+++ b/src/imap/imap-fetch-body.c Wed Jul 02 18:21:24 2014 +0300
@@ -208,19 +208,7 @@
becomes too big and wraps. */
static int read_uoff_t(const char **p, uoff_t *value)
{
- uoff_t prev;
-
- *value = 0;
- while (**p >= '0' && **p <= '9') {
- prev = *value;
- *value = *value * 10 + (**p - '0');
-
- if (*value < prev)
- return -1;
-
- (*p)++;
- }
- return 0;
+ return str_parse_uoff(*p, value, p);
}
static int
More information about the dovecot-cvs
mailing list