Prevent buffer overruns.

svn path=/trunk/; revision=1384

diff --git a/NEWS b/NEWS
index d4f24f94f74c6dfb11cc438f941f1bbc6a42ed27..2eebe8b5f0b66231858001160177568a136da1a7 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -15,7 +15,6 @@
 
 ------------------------------------------------------------------------------
 fetchmail-4.2.5 ()
-* Alexander Kourakos corrected his patch to avoid a buffer overrun.
 * Greg Stark's patch for better autoconfiguration on mixed libc5/libc6 systems.
 * We no longer mess with CFLAGS/LDFLAGS to get Kerberos support linked.
 

diff --git a/driver.c b/driver.c
index 04b6683b1b3abf91458e45dabc84bfd2dc73a86e..79a95b646ec6add91e02d97e8e1b81efd4e856b8 100644 (file)
--- a/driver.c
+++ b/driver.c
@@ -562,8 +562,9 @@ int num;            /* index of message */
            }
 
            set_timeout(ctl->server.timeout);
-           /* leave extra room for reply_hack to play with */
-           line = (char *) realloc(line, strlen(line) + strlen(buf) + HOSTLEN + 1);
+
+           line = (char *) realloc(line, strlen(line) + strlen(buf) +1);
+
            strcat(line, buf);
            if (line[0] == '\r' && line[1] == '\n')
                break;
@@ -671,7 +672,7 @@ int num;            /* index of message */
        }
 
        if (ctl->rewrite)
-           reply_hack(line, realname);
+           line = reply_hack(line, realname);
 
        if (!headers)
        {

diff --git a/fetchmail.h b/fetchmail.h
index 376c5f83a28352090dd3fa4b798768e13de79a1e..f9de3d203f955c3737340f11f53fa4972b85920f 100644 (file)
--- a/fetchmail.h
+++ b/fetchmail.h
@@ -237,7 +237,7 @@ int gen_transact ();
 #endif
 
 /* rfc822.c: RFC822 header parsing */
-void reply_hack(char *, const char *);
+char *reply_hack(char *, const char *);
 char *nxtaddr(const char *);
 
 /* uid.c: UID support */

diff --git a/rfc822.c b/rfc822.c
index 5e9e2da56a63bb8690262af1d0ee2a56dc68a684..14187bde625f8584243da62e86de447473e2cd42 100644 (file)
--- a/rfc822.c
+++ b/rfc822.c
@@ -20,13 +20,14 @@
 static int verbose;
 #endif /* TESTMAIN */
 
-void reply_hack(buf, host)
+char *reply_hack(buf, host)
 /* hack message headers so replies will work properly */
 char *buf;             /* header to be hacked */
 const char *host;      /* server hostname */
 {
     char *from, *cp;
     int parendepth, state, has_bare_name_part, has_host_part;
+    int addresscount = 1;
 
     if (strncasecmp("From: ", buf, 6)
        && strncasecmp("To: ", buf, 4)
@@ -34,9 +35,17 @@ const char *host;    /* server hostname */
        && strncasecmp("Return-Path: ", buf, 13)
        && strncasecmp("Cc: ", buf, 4)
        && strncasecmp("Bcc: ", buf, 5)) {
-       return;
+       return(buf);
     }
 
+#ifndef TESTMAIN
+    /* make room to hack the address; buf must be malloced */
+    for (cp = buf; *cp; cp++)
+       if (*cp == ',' || isspace(*cp))
+           addresscount++;
+    buf = (char *)realloc(buf, strlen(buf) + addresscount * strlen(host) + 1);
+#endif /* TESTMAIN */
+
     parendepth = state = 0;
     has_host_part = has_bare_name_part = FALSE;
     for (from = buf; *from; from++)
@@ -130,6 +139,8 @@ const char *host;   /* server hostname */
          has_host_part = has_bare_name_part = FALSE;
        }
     }
+
+    return(buf);
 }
 
 char *nxtaddr(hdr)