diff options
| author | Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de> | 2021-04-12 23:05:44 +0200 |
|---|---|---|
| committer | Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de> | 2021-05-27 21:30:57 +0200 |
| commit | f83d4a2b3fedd9a8a0e7367db82a68a719f08e30 (patch) | |
| tree | 49359f063330ed5734566e764f442bb0353d68f1 | |
| parent | 55ab0c211c3e0def1016971d3b3ebd47c006a751 (diff) | |
CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
Based on Phil Pennock's commit 76a1ce77.
Modified by Qualys.
(cherry picked from commit f218fef171cbe9e61d10f15399aab8fa6956535b)
(cherry picked from commit 8b1e9bc2cac17ee24d595c97dcf97d9b016f8a46)
| -rw-r--r-- | src/src/parse.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/src/parse.c b/src/src/parse.c index e0470c86f..fa3395206 100644 --- a/src/src/parse.c +++ b/src/src/parse.c @@ -984,12 +984,12 @@ if (i < len) /* No non-printers; use the RFC 822 quoting rules */ -if (!len) +if (len <= 0 || len >= INT_MAX/4) { - return string_copy_taint(US"", is_tainted(phrase)); + return string_copy_taint(CUS"", is_tainted(phrase)); } -buffer = store_get(len*4, is_tainted(phrase)); +buffer = store_get((len+1)*4, is_tainted(phrase)); s = phrase; end = s + len; |