From 427e205f3f5759c153a1d424ac6f6a82ac16a352 Mon Sep 17 00:00:00 2001 From: Kevin McCarthy Date: Sun, 3 Sep 2023 14:11:48 +0800 Subject: [PATCH] (CVE-2023-4874) Fix write_one_header() illegal header check. This is another crash caused by the rfc2047 decoding bug fixed in the second prior commit. In this case, an empty header line followed by a header line starting with ":", would result in t==end. The mutt_substrdup() further below would go very badly at that point, with t >= end+1. This could result in either a memcpy onto NULL or a huge malloc call. Thanks to Chenyuan Mi (@morningbread) for giving a working example draft message of the rfc2047 decoding flaw. This allowed me, with further testing, to discover this additional crash bug. (cherry picked from commit a4752eb0ae0a521eec02e59e51ae5daedf74fda0) --- sendlib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sendlib.c b/sendlib.c index 8fd5e6cb..8569e5cf 100644 --- a/sendlib.c +++ b/sendlib.c @@ -2038,7 +2038,7 @@ static int write_one_header (FILE *fp, int pfxw, int max, int wraplen, else { t = strchr (start, ':'); - if (!t || t > end) + if (!t || t >= end) { dprint (1, (debugfile, "mwoh: warning: header not in " "'key: value' format!\n"));