List:     mutt-dev
Subject:  [1.3.28] Patch: Buffer overflow in imap/util.c
From:     Byrial Jensen <byrial () image ! dk>
Date:     2002-04-28 20:20:04

--GvXjxJ+pjyke8COw
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

There is a possible buffer overflow due an off-by-one error in
imap/util.c, line 125. The error is in the maximum field width
indication in the sscanf() call. You must have room in the
receiving buffer for this number of characters /plus a
terminating NULL character/.

--GvXjxJ+pjyke8COw
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="patch-1.3.28.bj.sscanf_fix.1"

--- imap/util.c~	Sun Jan 13 22:16:34 2002
+++ imap/util.c	Sun Apr 28 21:56:29 2002
@@ -122,7 +122,7 @@ int imap_parse_path (const char* path, I
   else
   {
     FREE (&c);
-    if (sscanf (path, "{%128[^}]}", tmp) != 1) 
+    if (sscanf (path, "{%127[^}]}", tmp) != 1)
       return -1;
 
     c = strchr (path, '}');
@@ -140,7 +140,7 @@ int imap_parse_path (const char* path, I
       mx->account.flags |= M_ACCT_USER;
     }
   
-    if ((n = sscanf (tmp, "%128[^:/]%128s", mx->account.host, tmp)) < 1)
+    if ((n = sscanf (tmp, "%127[^:/]%127s", mx->account.host, tmp)) < 1)
     {
       dprint (1, (debugfile, "imap_parse_path: NULL host in %s\n", path));
       FREE (&mx->mbox);
@@ -148,7 +148,7 @@ int imap_parse_path (const char* path, I
     }
   
     if (n > 1) {
-      if (sscanf (tmp, ":%hd%128s", &(mx->account.port), tmp) >= 1)
+      if (sscanf (tmp, ":%hd%127s", &(mx->account.port), tmp) >= 1)
 	mx->account.flags |= M_ACCT_PORT;
       if (sscanf (tmp, "/%s", tmp) == 1)
       {

--GvXjxJ+pjyke8COw--