|
 |
117356 |
Index: bogofilter/src/lexer.c
|
|
|
117356 |
===================================================================
|
|
|
117356 |
--- bogofilter/src/lexer.c (revision 7029)
|
|
|
117356 |
+++ bogofilter/src/lexer.c (revision 7030)
|
|
|
117356 |
@@ -329,7 +329,7 @@
|
|
|
117356 |
count += cnt;
|
|
|
117356 |
|
|
|
117356 |
/* Note: some malformed messages can cause xfgetsl() to report
|
|
|
117356 |
- ** "Invalid buffer size, exiting." ** and then abort. This
|
|
|
117356 |
+ ** "Invalid buffer size, exiting." and then abort. This
|
|
|
117356 |
** can happen when the parser is in html mode and there's a
|
|
|
117356 |
** leading '<' but no closing '>'.
|
|
|
117356 |
**
|
|
|
117356 |
@@ -343,9 +343,12 @@
|
|
|
117356 |
|
|
|
117356 |
if (count >= MAX_TOKEN_LEN * 2 &&
|
|
|
117356 |
long_token(buff.t.u.text, (uint) count)) {
|
|
|
117356 |
- uint start = buff.t.leng - count;
|
|
|
117356 |
- uint length = count - max_token_len;
|
|
|
117356 |
- buff_shift(&buff, start, length);
|
|
|
117356 |
+ /* Make sure not to shift bytes outside the buffer */
|
|
|
117356 |
+ if (buff.t.leng >= (uint) count) {
|
|
|
117356 |
+ uint start = buff.t.leng - count;
|
|
|
117356 |
+ uint length = count - max_token_len;
|
|
|
117356 |
+ buff_shift(&buff, start, length);
|
|
|
117356 |
+ }
|
|
|
117356 |
count = buff.t.leng;
|
|
|
117356 |
}
|
|
|
117356 |
else
|
|
|
117356 |
Index: bogofilter/NEWS
|
|
|
117356 |
===================================================================
|
|
|
117356 |
--- bogofilter/NEWS (revision 7029)
|
|
|
117356 |
+++ bogofilter/NEWS (revision 7030)
|
|
|
117356 |
@@ -15,6 +15,14 @@
|
|
|
117356 |
|
|
|
117356 |
-------------------------------------------------------------------------------
|
|
|
117356 |
|
|
|
117356 |
+ 2015-02-28
|
|
|
117356 |
+
|
|
|
117356 |
+ * Fix the lexer to not try to delete parts from HTML tokens if it is
|
|
|
117356 |
+ reading garbage (for instance, binary files misdeclared as HTML).
|
|
|
117356 |
+ This was exposed on Fedora 20 and 21 but not Ubuntu 14.04 (x86_64),
|
|
|
117356 |
+ and is possibly related to its newer flex 2.5.37 that may have
|
|
|
117356 |
+ changed the way it uses yyinput() a bit. Reported by Matt Garretson.
|
|
|
117356 |
+
|
|
|
117356 |
2015-02-25
|
|
|
117356 |
|
|
|
117356 |
* Fix the lexer to handle MIME multipart messages properly when the
|