Validate STAT response more strictly.

diff --git a/pop3.c b/pop3.c
index 0cf58da776cbf469ba423919fbe1ce35b72d3185..b1f9621c2d8ce5512ef4ef2633afc49ddb0fcf5c 100644 (file)
--- a/pop3.c
+++ b/pop3.c
@@ -1009,9 +1009,13 @@ static int pop3_getrange(int sock,
     /* get the total message count */
     gen_send(sock, "STAT");
     ok = pop3_ok(sock, buf);
-    if (ok == 0)
-       sscanf(buf,"%d %d", countp, bytes);
-    else
+    if (ok == 0) {
+       int asgn;
+
+       asgn = sscanf(buf,"%d %d", countp, bytes);
+       if (asgn != 2)
+               return PS_PROTOCOL;
+    } else
        return(ok);
 
     /*