82ee7a6c14
- check Maildir for not being NULL when expanding '='-paths - prevent mailto parsing buffer overflow by ignoring too long header - use strtok_r() to parse mailto: links, not strtok() - update UPDATING
114 lines
3.3 KiB
Diff
114 lines
3.3 KiB
Diff
# HG changeset patch
|
|
# User Rocco Rutte <pdmef@gmx.net>
|
|
# Date 1194196465 -3600
|
|
# Branch HEAD
|
|
# Node ID 6248b3c04f61fcbd447bed96030cb7a4887b69b6
|
|
# Parent 2157b46eb93823e5c38136fe49c9b16c1475f27b
|
|
Prevent mailto parsing buffer overflow by ignoring too long header.
|
|
If they're longer than our buffer, we can't turn it into a header to
|
|
be parsed by mutt_parse_rfc822_line() anyway, so we bail out in this
|
|
case. Also make main() catchup mailto parsing errors. Closes #2980.
|
|
|
|
diff -r 2157b46eb938 -r 6248b3c04f61 main.c
|
|
--- a/main.c Sun Nov 04 17:02:56 2007 +0100
|
|
+++ b/main.c Sun Nov 04 18:14:25 2007 +0100
|
|
@@ -829,7 +829,15 @@ int main (int argc, char **argv)
|
|
for (i = optind; i < argc; i++)
|
|
{
|
|
if (url_check_scheme (argv[i]) == U_MAILTO)
|
|
- url_parse_mailto (msg->env, &bodytext, argv[i]);
|
|
+ {
|
|
+ if (url_parse_mailto (msg->env, &bodytext, argv[i]) < 0)
|
|
+ {
|
|
+ if (!option (OPTNOCURSES))
|
|
+ mutt_endwin (NULL);
|
|
+ fputs (_("Failed to parse mailto: link\n"), stderr);
|
|
+ exit (1);
|
|
+ }
|
|
+ }
|
|
else
|
|
msg->env->to = rfc822_parse_adrlist (msg->env->to, argv[i]);
|
|
}
|
|
diff -r 2157b46eb938 -r 6248b3c04f61 url.c
|
|
--- a/url.c Sun Nov 04 17:02:56 2007 +0100
|
|
+++ b/url.c Sun Nov 04 18:14:25 2007 +0100
|
|
@@ -217,7 +217,7 @@ int url_parse_mailto (ENVELOPE *e, char
|
|
char *tag, *value;
|
|
char scratch[HUGE_STRING];
|
|
|
|
- int taglen;
|
|
+ int taglen, rc = 0;
|
|
|
|
LIST *last = NULL;
|
|
|
|
@@ -250,19 +250,25 @@ int url_parse_mailto (ENVELOPE *e, char
|
|
if (body)
|
|
mutt_str_replace (body, value);
|
|
}
|
|
- else
|
|
- {
|
|
- taglen = strlen (tag);
|
|
- /* mutt_parse_rfc822_line makes some assumptions */
|
|
+ else if ((taglen = mutt_strlen (tag)) <= sizeof (scratch) - 2)
|
|
+ {
|
|
+ /* only try to parse if we can format it as header for
|
|
+ * mutt_parse_rfc822_line (tag fits in scratch) */
|
|
snprintf (scratch, sizeof (scratch), "%s: %s", tag, value);
|
|
scratch[taglen] = '\0';
|
|
value = &scratch[taglen+1];
|
|
SKIPWS (value);
|
|
mutt_parse_rfc822_line (e, NULL, scratch, value, 1, 0, 0, &last);
|
|
}
|
|
- }
|
|
-
|
|
+ else
|
|
+ {
|
|
+ rc = -1;
|
|
+ goto out;
|
|
+ }
|
|
+ }
|
|
+
|
|
+out:
|
|
FREE (&tmp);
|
|
- return 0;
|
|
-}
|
|
-
|
|
+ return rc;
|
|
+}
|
|
+
|
|
# HG changeset patch
|
|
# User cypher@conuropsis.org
|
|
# Date 1194197244 -3600
|
|
# Branch HEAD
|
|
# Node ID ab676b9f0c040644f27c1fb862a7d67171c553c7
|
|
# Parent 6248b3c04f61fcbd447bed96030cb7a4887b69b6
|
|
Use strtok_r() to parse mailto: links, not strtok().
|
|
In case a headers needs to call mutt_parse_references() which uses
|
|
strtok(), too, later headers will be silently discarded. Closes #2968.
|
|
|
|
diff -r 6248b3c04f61 -r ab676b9f0c04 url.c
|
|
--- a/url.c Sun Nov 04 18:14:25 2007 +0100
|
|
+++ b/url.c Sun Nov 04 18:27:24 2007 +0100
|
|
@@ -211,7 +211,7 @@ int url_ciss_tostring (ciss_url_t* ciss,
|
|
|
|
int url_parse_mailto (ENVELOPE *e, char **body, const char *src)
|
|
{
|
|
- char *t;
|
|
+ char *t, *p;
|
|
char *tmp;
|
|
char *headers;
|
|
char *tag, *value;
|
|
@@ -233,9 +233,9 @@ int url_parse_mailto (ENVELOPE *e, char
|
|
url_pct_decode (tmp);
|
|
e->to = rfc822_parse_adrlist (e->to, tmp);
|
|
|
|
- tag = headers ? strtok (headers, "&") : NULL;
|
|
-
|
|
- for (; tag; tag = strtok (NULL, "&"))
|
|
+ tag = headers ? strtok_r (headers, "&", &p) : NULL;
|
|
+
|
|
+ for (; tag; tag = strtok_r (NULL, "&", &p))
|
|
{
|
|
if ((value = strchr (tag, '=')))
|
|
*value++ = '\0';
|