Subject: [Imap-uw] rfc822_write_address_full

From: John Dalbec <[email-masked]>
Date: Fri, 02 Dec 2005 14:56:34 -0500

I'm trying to fix a buffer overflow in PHP-IMAP.  It declares a buffer of size 
MAILTMPLEN (=1024) and then uses rfc822_write_address_full to write a canonical 
version of the first address from each of the From: and To: headers into the 
buffer.  I found an e-mail in a user's INBOX that had a corrupted To: header 
with unbalanced double quotes that made the whole thing look like one long 
e-mail address.  This e-mail triggered a segfault every time the user tried to 
log in to Horde.

Is there a snprintf-style version of rfc822_write_address_full that could be 
used instead?  Would it be reasonable to limit rfc822_write_address_full to 
writing at most MAILTMPLEN bytes?

Thanks,
John Dalbec
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Mark Crispin <[email-masked]>
Date: Fri, 2 Dec 2005 12:59:10 -0800 (PST)

rfc822_write_address_full() is a legacy function.  It's used in c-client 
in only two places: as part rfc822_header(), and in address searching 
(which does a bounds check).

rfc822_header() is also legacy; it's called from rfc822_output() which the 
application is supported to replace with its own rfc822out_t function.

Basically, you either need to do the equivalent bounds checking to what is 
done by mail_search_addr(), or use your own function to write the address.

It's been on my list for some time to get rid of these routines in favor 
of routines which use the soutr_t mechanism (since their primary purpose 
is for rfc822_output(), and make the old names be macros into the new 
interface.  Thanks for reminding me.

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw