From 7f28151c0b6bca5cb60f56e9a17ccb2fd9665269 Mon Sep 17 00:00:00 2001 From: Oliver Kiddle Date: Sat, 7 Apr 2018 18:28:38 +0200 Subject: [PATCH] 42607, CVE-2018-1100: check bounds on buffer in mail checking Upstream-commit: 31f72205630687c1cef89347863aab355296a27f Signed-off-by: Kamil Dudka --- Src/utils.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/Src/utils.c b/Src/utils.c index c6eba63..41ec45c 100644 --- a/Src/utils.c +++ b/Src/utils.c @@ -1419,7 +1419,7 @@ checkmailpath(char **s) LinkList l; DIR *lock = opendir(unmeta(*s)); char buf[PATH_MAX * 2], **arr, **ap; - int ct = 1; + int buflen, ct = 1; if (lock) { char *fn; @@ -1428,9 +1428,11 @@ checkmailpath(char **s) l = newlinklist(); while ((fn = zreaddir(lock, 1)) && !errflag) { if (u) - sprintf(buf, "%s/%s?%s", *s, fn, u); + buflen = snprintf(buf, sizeof(buf), "%s/%s?%s", *s, fn, u); else - sprintf(buf, "%s/%s", *s, fn); + buflen = snprintf(buf, sizeof(buf), "%s/%s", *s, fn); + if (buflen < 0 || buflen >= (int)sizeof(buf)) + continue; addlinknode(l, dupstring(buf)); ct++; } -- 2.14.3