Mercurial > libpst
diff src/libpst.c @ 41:183ae993b9ad
security fix for potential buffer overrun in lz decompress
author | carl |
---|---|
date | Tue, 02 Oct 2007 15:49:44 -0700 |
parents | be6d5329cc01 |
children | f6db1f060a95 |
line wrap: on
line diff
--- a/src/libpst.c Fri Aug 24 18:57:59 2007 -0700 +++ b/src/libpst.c Tue Oct 02 15:49:44 2007 -0700 @@ -1494,11 +1494,17 @@ #define MALLOC_MESSAGESTORE(x) { if (!x->message_store) { x->message_store = (pst_item_message_store*) xmalloc(sizeof(pst_item_message_store)); memset(x->message_store, 0, sizeof(pst_item_message_store));} } #define MALLOC_JOURNAL(x) { if (!x->journal) { x->journal = (pst_item_journal*) xmalloc(sizeof(pst_item_journal)); memset(x->journal, 0, sizeof(pst_item_journal) );} } #define MALLOC_APPOINTMENT(x) { if (!x->appointment) { x->appointment = (pst_item_appointment*) xmalloc(sizeof(pst_item_appointment)); memset(x->appointment, 0, sizeof(pst_item_appointment) );} } -// malloc space and copy the current item's data -- plus one on the size for good luck (and string termination) -#define LIST_COPY(targ, type) { \ - targ = type realloc(targ, list->items[x]->size+1); \ - memset(targ, 0, list->items[x]->size+1); \ +// malloc space and copy the current item's data null terminated +#define LIST_COPY(targ, type) { \ + targ = type realloc(targ, list->items[x]->size+1); \ memcpy(targ, list->items[x]->data, list->items[x]->size); \ + memset(((char*)targ)+list->items[x]->size, 0, 1); \ +} +// malloc space and copy the current item's data and size +#define LIST_COPY_SIZE(targ, type, mysize) { \ + mysize = list->items[x]->size; \ + targ = type realloc(targ, mysize); \ + memcpy(targ, list->items[x]->data, mysize); \ } #define NULL_CHECK(x) { if (!x) { DEBUG_EMAIL(("NULL_CHECK: Null Found\n")); break;} } @@ -2026,7 +2032,7 @@ // it is unknown DEBUG_EMAIL(("RTF Compressed body - ")); MALLOC_EMAIL(item); - LIST_COPY(item->email->rtf_compressed, (char*)); + LIST_COPY_SIZE(item->email->rtf_compressed, (char*), item->email->rtf_compressed_size); DEBUG_EMAIL(("NOT PRINTED\n")); break; case 0x1010: // PR_RTF_SYNC_PREFIX_COUNT