Subject: [PATCH] buffer overrun in rfc822_8bit()

From: Antony Dovgal <[email-masked]>
Date: Fri, 7 Jan 2005 02:00:20 +0300

Hi all!

Trying to find a cause of http://bugs.php.net/31431 I've discovered 
that rfc822_8bit() function (from src/c-client/rfc822.c, line 1938) 
incorrectly computes maximum result length.
This causes buffer overrun & segfault.

Current formula:
---
  unsigned char *ret = (unsigned char *)  
  fs_get ((size_t) (3*srcl + (6*srcl)/MAXL + 3));1
---

As far as I understand this formula should be written like this:
---
3[encoded char len]*source length 
+ 
((3[encoded char len]*source length)/MAXL[max line length])*3[line ending: "=\r\n"])
+
3["=\r\n" at the end]
---

So, c-client should use this line instead:
---
   unsigned char *ret = (unsigned char *)
    fs_get ((size_t) (3*srcl + ((3*srcl)/MAXL)*3 + 3));
---

The patch is attached.
Thanks.

-- 
Wbr, 
Antony Dovgal aka tony2001
--- rfc822.c.orig	2005-01-07 01:53:34.652514640 +0300
+++ rfc822.c	2005-01-07 01:53:58.716856304 +0300
@@ -1940,7 +1940,7 @@
 {
   unsigned long lp = 0;
   unsigned char *ret = (unsigned char *)
-    fs_get ((size_t) (3*srcl + (6*srcl)/MAXL + 3));
+    fs_get ((size_t) (3*srcl + ((3*srcl)/MAXL)*3 + 3));
   unsigned char *d = ret;
   char *hex = "0123456789ABCDEF";
   unsigned char c;

---

From: Mark Crispin <[email-masked]>
Date: Tue, 11 Jan 2005 14:50:23 -0800 (Pacific Standard Time)

Thank you.  I agree with your suggested patch, and it will be in the next 
release.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: Antony Dovgal <[email-masked]>
Date: Wed, 12 Jan 2005 01:55:38 +0300

On Tue, 11 Jan 2005 14:50:23 -0800 (Pacific Standard Time)
Mark Crispin <[email-masked]> wrote:

> Thank you.  I agree with your suggested patch, and it will be in the
> next release.

Thanks!