nightmaremail

commit e794b49925c1a1762aece35a5d7e09f1444d1ab7
parent 2fe3ac71d35e68d1d42273a3925b9f7dc8020742
Author: Rolf Eike Beer <eike@sf-mail.de>
Date:   Mon, 11 May 2020 18:55:11 +0200

fix signedness wraparound in substdio_put() (CVE-2005-1515)

Diffstat:
M
qmail.c
 | 
2
+-
M
substdo.c
 | 
14
++++++++------

2 files changed, 9 insertions(+), 7 deletions(-)
diff --git a/qmail.c b/qmail.c
@@ -61,7 +61,7 @@ void qmail_fail(qq) struct qmail *qq;
   qq->flagerr = 1;
 }
 
-void qmail_put(qq,s,len) struct qmail *qq; char *s; int len;
+void qmail_put(qq,s,len) struct qmail *qq; char *s; unsigned int len;
 {
   if (!qq->flagerr) if (substdio_put(&qq->ss,s,len) == -1) qq->flagerr = 1;
 }
diff --git a/substdo.c b/substdo.c
@@ -7,7 +7,7 @@ static int allwrite(op,fd,buf,len)
 register int (*op)();
 register int fd;
 register char *buf;
-register int len;
+register unsigned int len;
 {
   register int w;
 
@@ -55,16 +55,18 @@ register int len;
 int substdio_put(s,buf,len)
 register substdio *s;
 register char *buf;
-register int len;
+register unsigned int len;
 {
-  register int n;
+  register unsigned int n = s->n; /* how many bytes to write in next chunk */
  
-  n = s->n;
-  if (len > n - s->p) {
+  /* check if the input would fit in the buffer without flushing */
+  if (len > n - (unsigned int)s->p) {
     if (substdio_flush(s) == -1) return -1;
     /* now s->p == 0 */
     if (n < SUBSTDIO_OUTSIZE) n = SUBSTDIO_OUTSIZE;
-    while (len > s->n) {
+    /* as long as the remainder would not fit into s->x write it directly
+     * from buf to s->fd. */
+    while (len > (unsigned int)s->n) {
       if (n > len) n = len;
       if (allwrite(s->op,s->fd,buf,n) == -1) return -1;
       buf += n;