libsieve: Fixed several sprintf() buffer overflows.
authorTimo Sirainen <tss@iki.fi>
Sun Sep 13 19:26:42 2009 -0400 (2009-09-13)
changeset 724577c4e1130d
parent 71 c1402bcf9bd3
child 73 049f22520628
libsieve: Fixed several sprintf() buffer overflows.
src/libsieve/bc_eval.c
src/libsieve/script.c
     1.1 --- a/src/libsieve/bc_eval.c	Tue Sep 01 13:24:21 2009 -0400
     1.2 +++ b/src/libsieve/bc_eval.c	Sun Sep 13 19:26:42 2009 -0400
     1.3 @@ -477,7 +477,7 @@
     1.4  	int comparator=ntohl(bc[i+3].value);
     1.5  	int apart=ntohl(bc[i+4].value);
     1.6  	int count=0;
     1.7 -	char scount[3];
     1.8 +	char scount[20];
     1.9  	int isReg = (match==B_REGEX);
    1.10  	int ctag = 0;
    1.11  	regex_t *reg;
    1.12 @@ -646,7 +646,7 @@
    1.13  	int relation=ntohl(bc[i+2].value);
    1.14  	int comparator=ntohl(bc[i+3].value);
    1.15  	int count=0;	
    1.16 -	char scount[3];
    1.17 +	char scount[20];
    1.18  	int isReg = (match==B_REGEX);
    1.19  	int ctag = 0;
    1.20  	regex_t *reg;
    1.21 @@ -767,7 +767,7 @@
    1.22  	int transform=ntohl(bc[i+4].value);
    1.23  	/*int offset=ntohl(bc[i+5].value);*/
    1.24  	int count=0;
    1.25 -	char scount[3];
    1.26 +	char scount[20];
    1.27  	int isReg = (match==B_REGEX);
    1.28  	int ctag = 0;
    1.29  	regex_t *reg;
     2.1 --- a/src/libsieve/script.c	Tue Sep 01 13:24:21 2009 -0400
     2.2 +++ b/src/libsieve/script.c	Sun Sep 13 19:26:42 2009 -0400
     2.3 @@ -609,9 +609,9 @@
     2.4      if ((ret != SIEVE_OK) && interp->err) {
     2.5  	char buf[1024];
     2.6  	if (lastaction == -1) /* we never executed an action */
     2.7 -	    sprintf(buf, "%s", errmsg ? errmsg : sieve_errstr(ret));
     2.8 +	    snprintf(buf, sizeof(buf), "%s", errmsg ? errmsg : sieve_errstr(ret));
     2.9  	else
    2.10 -	    sprintf(buf, "%s: %s", action_to_string(lastaction),
    2.11 +	    snprintf(buf, sizeof(buf), "%s: %s", action_to_string(lastaction),
    2.12  		    errmsg ? errmsg : sieve_errstr(ret));
    2.13   
    2.14  	ret |= interp->execute_err(buf, interp->interp_context,
    2.15 @@ -629,7 +629,7 @@
    2.16  	ret |= keep_ret;
    2.17          if (keep_ret == SIEVE_OK)
    2.18              snprintf(actions_string+strlen(actions_string),
    2.19 -		     sizeof(actions_string)-strlen(actions_string),
    2.20 +		     ACTIONS_STRING_LEN-strlen(actions_string),
    2.21  		     "Kept\n");
    2.22  	else {
    2.23  	    implicit_keep = 0;	/* don't try an implicit keep again */
    2.24 @@ -682,7 +682,7 @@
    2.25  	    
    2.26  	    if (ret == SIEVE_OK)
    2.27  		snprintf(actions_string+strlen(actions_string),
    2.28 -			 sizeof(actions_string)-strlen(actions_string), 
    2.29 +			 ACTIONS_STRING_LEN-strlen(actions_string), 
    2.30  			 "Rejected with: %s\n", a->u.rej.msg);
    2.31  
    2.32  	    break;
    2.33 @@ -697,7 +697,7 @@
    2.34  
    2.35  	    if (ret == SIEVE_OK)
    2.36  		snprintf(actions_string+strlen(actions_string),
    2.37 -			 sizeof(actions_string)-strlen(actions_string),
    2.38 +			 ACTIONS_STRING_LEN-strlen(actions_string),
    2.39  			 "Filed into: %s\n",a->u.fil.mailbox);
    2.40  	    break;
    2.41  	case ACTION_KEEP:
    2.42 @@ -710,7 +710,7 @@
    2.43  			       &errmsg);
    2.44  	    if (ret == SIEVE_OK)
    2.45  		snprintf(actions_string+strlen(actions_string),
    2.46 -			 sizeof(actions_string)-strlen(actions_string),
    2.47 +			 ACTIONS_STRING_LEN-strlen(actions_string),
    2.48  			 "Kept\n");
    2.49  	    break;
    2.50  	case ACTION_REDIRECT:
    2.51 @@ -723,7 +723,7 @@
    2.52  				   &errmsg);
    2.53  	    if (ret == SIEVE_OK)
    2.54  		snprintf(actions_string+strlen(actions_string),
    2.55 -			 sizeof(actions_string)-strlen(actions_string),
    2.56 +			 ACTIONS_STRING_LEN-strlen(actions_string),
    2.57  			 "Redirected to %s\n", a->u.red.addr);
    2.58  	    break;
    2.59  	case ACTION_DISCARD:
    2.60 @@ -734,7 +734,7 @@
    2.61  				      &errmsg);
    2.62  	    if (ret == SIEVE_OK)
    2.63  		snprintf(actions_string+strlen(actions_string),
    2.64 -			 sizeof(actions_string)-strlen(actions_string),
    2.65 +			 ACTIONS_STRING_LEN-strlen(actions_string),
    2.66  			 "Discarded\n");
    2.67  	    break;
    2.68  
    2.69 @@ -760,12 +760,12 @@
    2.70  
    2.71  		    if (ret == SIEVE_OK)
    2.72  			snprintf(actions_string+strlen(actions_string),
    2.73 -				 sizeof(actions_string)-strlen(actions_string),
    2.74 +				 ACTIONS_STRING_LEN-strlen(actions_string),
    2.75  				 "Sent vacation reply\n");
    2.76  
    2.77  		} else if (ret == SIEVE_DONE) {
    2.78  		    snprintf(actions_string+strlen(actions_string),
    2.79 -			     sizeof(actions_string)-strlen(actions_string),
    2.80 +			     ACTIONS_STRING_LEN-strlen(actions_string),
    2.81  			     "Vacation reply suppressed\n");
    2.82  
    2.83  		    ret = SIEVE_OK;