Projects STRLCPY neomutt Commits e26b521f
🤬
  • merge: imap: fix crash

    * imap: fix formatters
     * imap: fix oob write during debug on 32 bit systems
     * buffer: never shrink
  • Loading...
  • Richard Russon committed 2 years ago
    e26b521f
Revision indexing in progress... (symbol navigation in revisions will be accurate after indexed)
  • ■ ■ ■ ■ ■ ■
    imap/imap.c
    skipped 603 lines
    604 604   
    605 605   const short c_debug_level = cs_subset_number(NeoMutt->sub, "debug_level");
    606 606   if (c_debug_level >= IMAP_LOG_LTRL)
    607  - mutt_buffer_alloc(&buf, bytes + 10);
     607 + mutt_buffer_alloc(&buf, bytes + 1);
    608 608   
    609  - mutt_debug(LL_DEBUG2, "reading %ld bytes\n", bytes);
     609 + mutt_debug(LL_DEBUG2, "reading %lu bytes\n", bytes);
    610 610   
    611 611   for (unsigned long pos = 0; pos < bytes; pos++)
    612 612   {
    613 613   if (mutt_socket_readchar(adata->conn, &c) != 1)
    614 614   {
    615  - mutt_debug(LL_DEBUG1, "error during read, %ld bytes read\n", pos);
     615 + mutt_debug(LL_DEBUG1, "error during read, %lu bytes read\n", pos);
    616 616   adata->status = IMAP_FATAL;
    617 617   
    618 618   mutt_buffer_dealloc(&buf);
    skipped 1896 lines
  • ■ ■ ■ ■ ■
    mutt/buffer.c
    skipped 29 lines
    30 30  #include "config.h"
    31 31  #include <stdarg.h>
    32 32  #include <stdbool.h>
     33 +#include <stdint.h>
    33 34  #include <stdio.h>
    34 35  #include <string.h>
    35 36  #include "buffer.h"
    skipped 231 lines
    267 268   if (!buf)
    268 269   return;
    269 270   
    270  - if (buf->data && (new_size > 0) && (new_size <= buf->dsize))
     271 + if (buf->data && (new_size <= buf->dsize))
    271 272   return;
    272 273   
    273 274   const bool was_empty = (buf->dptr == NULL);
    274 275   const size_t offset = (buf->dptr && buf->data) ? (buf->dptr - buf->data) : 0;
    275 276   
    276  - buf->dsize = ROUND_UP(new_size + 1, BufferStepSize);
     277 + if (new_size > SIZE_MAX - BufferStepSize)
     278 + buf->dsize = SIZE_MAX;
     279 + else
     280 + buf->dsize = ROUND_UP(new_size + 1, BufferStepSize);
    277 281   mutt_mem_realloc(&buf->data, buf->dsize);
    278 282   mutt_buffer_seek(buf, offset);
    279 283   
    skipped 192 lines
Please wait...
Page is in error, reload to recover