libsieve: Fixed several sprintf() buffer overflows.
1.1 --- a/src/libsieve/bc_eval.c Tue Sep 01 13:24:21 2009 -0400
1.2 +++ b/src/libsieve/bc_eval.c Sun Sep 13 19:26:42 2009 -0400
1.3 @@ -477,7 +477,7 @@
1.4 int comparator=ntohl(bc[i+3].value);
1.5 int apart=ntohl(bc[i+4].value);
1.6 int count=0;
1.7 - char scount[3];
1.8 + char scount[20];
1.9 int isReg = (match==B_REGEX);
1.10 int ctag = 0;
1.11 regex_t *reg;
1.12 @@ -646,7 +646,7 @@
1.13 int relation=ntohl(bc[i+2].value);
1.14 int comparator=ntohl(bc[i+3].value);
1.15 int count=0;
1.16 - char scount[3];
1.17 + char scount[20];
1.18 int isReg = (match==B_REGEX);
1.19 int ctag = 0;
1.20 regex_t *reg;
1.21 @@ -767,7 +767,7 @@
1.22 int transform=ntohl(bc[i+4].value);
1.23 /*int offset=ntohl(bc[i+5].value);*/
1.24 int count=0;
1.25 - char scount[3];
1.26 + char scount[20];
1.27 int isReg = (match==B_REGEX);
1.28 int ctag = 0;
1.29 regex_t *reg;
2.1 --- a/src/libsieve/script.c Tue Sep 01 13:24:21 2009 -0400
2.2 +++ b/src/libsieve/script.c Sun Sep 13 19:26:42 2009 -0400
2.3 @@ -609,9 +609,9 @@
2.4 if ((ret != SIEVE_OK) && interp->err) {
2.5 char buf[1024];
2.6 if (lastaction == -1) /* we never executed an action */
2.7 - sprintf(buf, "%s", errmsg ? errmsg : sieve_errstr(ret));
2.8 + snprintf(buf, sizeof(buf), "%s", errmsg ? errmsg : sieve_errstr(ret));
2.9 else
2.10 - sprintf(buf, "%s: %s", action_to_string(lastaction),
2.11 + snprintf(buf, sizeof(buf), "%s: %s", action_to_string(lastaction),
2.12 errmsg ? errmsg : sieve_errstr(ret));
2.13
2.14 ret |= interp->execute_err(buf, interp->interp_context,
2.15 @@ -629,7 +629,7 @@
2.16 ret |= keep_ret;
2.17 if (keep_ret == SIEVE_OK)
2.18 snprintf(actions_string+strlen(actions_string),
2.19 - sizeof(actions_string)-strlen(actions_string),
2.20 + ACTIONS_STRING_LEN-strlen(actions_string),
2.21 "Kept\n");
2.22 else {
2.23 implicit_keep = 0; /* don't try an implicit keep again */
2.24 @@ -682,7 +682,7 @@
2.25
2.26 if (ret == SIEVE_OK)
2.27 snprintf(actions_string+strlen(actions_string),
2.28 - sizeof(actions_string)-strlen(actions_string),
2.29 + ACTIONS_STRING_LEN-strlen(actions_string),
2.30 "Rejected with: %s\n", a->u.rej.msg);
2.31
2.32 break;
2.33 @@ -697,7 +697,7 @@
2.34
2.35 if (ret == SIEVE_OK)
2.36 snprintf(actions_string+strlen(actions_string),
2.37 - sizeof(actions_string)-strlen(actions_string),
2.38 + ACTIONS_STRING_LEN-strlen(actions_string),
2.39 "Filed into: %s\n",a->u.fil.mailbox);
2.40 break;
2.41 case ACTION_KEEP:
2.42 @@ -710,7 +710,7 @@
2.43 &errmsg);
2.44 if (ret == SIEVE_OK)
2.45 snprintf(actions_string+strlen(actions_string),
2.46 - sizeof(actions_string)-strlen(actions_string),
2.47 + ACTIONS_STRING_LEN-strlen(actions_string),
2.48 "Kept\n");
2.49 break;
2.50 case ACTION_REDIRECT:
2.51 @@ -723,7 +723,7 @@
2.52 &errmsg);
2.53 if (ret == SIEVE_OK)
2.54 snprintf(actions_string+strlen(actions_string),
2.55 - sizeof(actions_string)-strlen(actions_string),
2.56 + ACTIONS_STRING_LEN-strlen(actions_string),
2.57 "Redirected to %s\n", a->u.red.addr);
2.58 break;
2.59 case ACTION_DISCARD:
2.60 @@ -734,7 +734,7 @@
2.61 &errmsg);
2.62 if (ret == SIEVE_OK)
2.63 snprintf(actions_string+strlen(actions_string),
2.64 - sizeof(actions_string)-strlen(actions_string),
2.65 + ACTIONS_STRING_LEN-strlen(actions_string),
2.66 "Discarded\n");
2.67 break;
2.68
2.69 @@ -760,12 +760,12 @@
2.70
2.71 if (ret == SIEVE_OK)
2.72 snprintf(actions_string+strlen(actions_string),
2.73 - sizeof(actions_string)-strlen(actions_string),
2.74 + ACTIONS_STRING_LEN-strlen(actions_string),
2.75 "Sent vacation reply\n");
2.76
2.77 } else if (ret == SIEVE_DONE) {
2.78 snprintf(actions_string+strlen(actions_string),
2.79 - sizeof(actions_string)-strlen(actions_string),
2.80 + ACTIONS_STRING_LEN-strlen(actions_string),
2.81 "Vacation reply suppressed\n");
2.82
2.83 ret = SIEVE_OK;