[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kde-devel
Subject:    kdemailcvt - patch for buffer overflow in dbx handling
From:       Cristi Dumitrescu <cristid () chip ! ro>
Date:       2001-04-07 17:27:41
[Download RAW message or body]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I've had some troubles importing some messages from Outlook 5.5, kmailcvt was 
crashing. So, if you experienced the same problem (crash in a free() call 
after importing some messages), this patch is for you. Tried to send it to 
the maintainer whose mail account quota seems to be exceeded =(
The solution *might* not be 100% complete, as I'm not completely sure that 
the buffer increase I did will do the trick in all cases - I didn't study the 
dbx format. I did not implement a check there, so if you still experience a 
crash, either increase the malloced buffer even more or implement proper 
bounds checking. Anyway it worked perfectly for my folders.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE6z04XqlE04vVf7AURAgAZAJ4z3BXet4HREXjj/kNtohOIf9GJcgCfXoEo
22BuEH+6Ma1hLR6FqI7HK7k=
=Xvz5
-----END PGP SIGNATURE-----

["patch-kmailcvt-buffer-overflow" (text/x-c)]

diff -u --recursive kdenetwork-2.1.1/kmailcvt-old/liboe.cxx kdenetwork-2.1.1/kmailcvt/liboe.cxx
--- kdenetwork-2.1.1/kmailcvt-old/liboe.cxx	Sat Nov 25 01:33:27 2000
+++ kdenetwork-2.1.1/kmailcvt/liboe.cxx	Sat Apr  7 20:00:05 2001
@@ -150,7 +150,7 @@
 		   int /*newsarticle*/) {
   int segheadsize = sizeof(oe_msg_segmentheader)-4; /*+(newsarticle<<2);*/
   oe_msg_segmentheader *sgm = (oe_msg_segmentheader *) malloc(sizeof(oe_msg_segmentheader));
-  char buff[16], *ss = (char *) malloc(2048), *s = ss;
+  char buff[16], *ss = (char *) malloc(16384), *s = ss;
   int nextsegment, endofsegment, i, headerwritten = 0;
   fseek(data->oe,pos,SEEK_SET);
   //fsetpos(data->oe,&pos);

>> Visit http://master.kde.org/mailman/listinfo/kde-devel#unsub to unsubscribe <<


[prev in list] [next in list] [prev in thread] [next in thread]