Skip to content

Commit d35936e

Browse files
committed
Prevent another buffer overflow, reported by libasan
1 parent 4646e76 commit d35936e

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

src/parse.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -924,7 +924,7 @@ static char *mdecodeRFC2047(char *string, int length, char *charsetsave)
924924
char charset[129];
925925
char encoding[33];
926926
char dummy[129];
927-
char *ptr;
927+
char *ptr, *endptr;
928928
char *old_output;
929929

930930
#ifdef NOTUSED
@@ -959,6 +959,7 @@ static char *mdecodeRFC2047(char *string, int length, char *charsetsave)
959959

960960
if (!strcasecmp("q", encoding)) {
961961
/* quoted printable decoding */
962+
endptr = ptr + strlen(ptr);
962963

963964
#ifdef HAVE_ICONV
964965
char *orig2,*output2,*output3;
@@ -967,7 +968,7 @@ static char *mdecodeRFC2047(char *string, int length, char *charsetsave)
967968
memset(output2,0,strlen(string)+1);
968969
old_output=output;
969970

970-
for (; *ptr; ptr++) {
971+
for (; ptr < endptr; ptr++) {
971972
switch (*ptr) {
972973
case '=':
973974
sscanf(ptr + 1, "%02X", &value);
@@ -991,7 +992,7 @@ static char *mdecodeRFC2047(char *string, int length, char *charsetsave)
991992
memcpy(charsetsave,charset,charsetlen);
992993
charsetsave[charsetlen] = '\0';
993994
#else
994-
for (; *ptr; ptr++) {
995+
for (; ptr < endptr; ptr++) {
995996
switch (*ptr) {
996997
case '=':
997998
sscanf(ptr + 1, "%02X", &value);

0 commit comments

Comments
 (0)