|
 |
da6346 |
From 7f28151c0b6bca5cb60f56e9a17ccb2fd9665269 Mon Sep 17 00:00:00 2001
|
|
|
da6346 |
From: Oliver Kiddle <okiddle@yahoo.co.uk>
|
|
|
da6346 |
Date: Sat, 7 Apr 2018 18:28:38 +0200
|
|
|
da6346 |
Subject: [PATCH] 42607, CVE-2018-1100: check bounds on buffer in mail checking
|
|
|
da6346 |
|
|
|
da6346 |
Upstream-commit: 31f72205630687c1cef89347863aab355296a27f
|
|
|
da6346 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
da6346 |
---
|
|
|
da6346 |
Src/utils.c | 8 +++++---
|
|
|
da6346 |
1 file changed, 5 insertions(+), 3 deletions(-)
|
|
|
da6346 |
|
|
|
da6346 |
diff --git a/Src/utils.c b/Src/utils.c
|
|
|
da6346 |
index c6eba63..41ec45c 100644
|
|
|
da6346 |
--- a/Src/utils.c
|
|
|
da6346 |
+++ b/Src/utils.c
|
|
|
495835 |
@@ -1419,7 +1419,7 @@ checkmailpath(char **s)
|
|
|
da6346 |
LinkList l;
|
|
|
da6346 |
DIR *lock = opendir(unmeta(*s));
|
|
|
da6346 |
char buf[PATH_MAX * 2], **arr, **ap;
|
|
|
da6346 |
- int ct = 1;
|
|
|
da6346 |
+ int buflen, ct = 1;
|
|
|
da6346 |
|
|
|
da6346 |
if (lock) {
|
|
|
da6346 |
char *fn;
|
|
|
495835 |
@@ -1428,9 +1428,11 @@ checkmailpath(char **s)
|
|
|
da6346 |
l = newlinklist();
|
|
|
da6346 |
while ((fn = zreaddir(lock, 1)) && !errflag) {
|
|
|
da6346 |
if (u)
|
|
|
da6346 |
- sprintf(buf, "%s/%s?%s", *s, fn, u);
|
|
|
da6346 |
+ buflen = snprintf(buf, sizeof(buf), "%s/%s?%s", *s, fn, u);
|
|
|
da6346 |
else
|
|
|
da6346 |
- sprintf(buf, "%s/%s", *s, fn);
|
|
|
da6346 |
+ buflen = snprintf(buf, sizeof(buf), "%s/%s", *s, fn);
|
|
|
da6346 |
+ if (buflen < 0 || buflen >= (int)sizeof(buf))
|
|
|
da6346 |
+ continue;
|
|
|
da6346 |
addlinknode(l, dupstring(buf));
|
|
|
da6346 |
ct++;
|
|
|
da6346 |
}
|
|
|
da6346 |
--
|
|
|
da6346 |
2.14.3
|
|
|
da6346 |
|