talons

commit 3b4a311d506acffb87e0c057825dee7c91b7ed0c
parent b629b57eb9d511fe15e1b418e7ed674e0764a65a
Author: Andrej Kacian <ticho@claws-mail.org>
Date:   Thu, 25 Apr 2019 22:20:06 +0200

Fix a runaway string read in procmime_decode_content()

We initialize output buffer for g_base64_decode_step()
to zeroes, so that we can later call strlen() on it
safely.
We also allocate one byte more than we write, so that
the trailing zero byte is guaranteed to be there.

Diffstat:
M
src/procmime.c
 | 
3
++-

1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/procmime.c b/src/procmime.c
@@ -366,7 +366,7 @@ gboolean procmime_decode_content(MimeInfo *mimeinfo)
 		if (flowed)
 			FLUSH_LASTLINE();
 	} else if (encoding == ENC_BASE64) {
-		gchar outbuf[BUFFSIZE];
+		gchar outbuf[BUFFSIZE + 1];
 		gint len, inlen, inread;
 		gboolean got_error = FALSE;
 		gboolean uncanonicalize = FALSE;
@@ -390,6 +390,7 @@ gboolean procmime_decode_content(MimeInfo *mimeinfo)
 
 		while ((inlen = MIN(readend - ftell(infp), sizeof(buf))) > 0 && !err) {
 			inread = claws_fread(buf, 1, inlen, infp);
+			memset(outbuf, 0, sizeof(buf));
 			len = g_base64_decode_step(buf, inlen, outbuf, &state, &save);
 			if (uncanonicalize == TRUE && strlen(outbuf) < len && starting) {
 				uncanonicalize = FALSE;