talons

commit 8b2aff884d97dcfe5cc70478fecc7c87ce023c95
parent fc42499ce0b3d1dc84914d5b15c9b5d19c904cd9
Author: Paul <paul@claws-mail.org>
Date:   Sun, 17 Jan 2016 11:34:14 +0000

fix CVE-2015-8708, bug 3557, 'Remotely exploitable bug.'

Patch by Ben Hutchings <ben@decadent.org.uk>

Diffstat:
M
AUTHORS
 | 
1
+
M
src/codeconv.c
 | 
17
+++++++++++++++--
M
src/gtk/authors.h
 | 
1
+

3 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/AUTHORS b/AUTHORS
@@ -305,3 +305,4 @@ contributors (in addition to the above; based on Changelog)
 	Arthur Huillet
 	Blatinox
 	Andy Balaam
+	Ben Hutchings
diff --git a/src/codeconv.c b/src/codeconv.c
@@ -158,7 +158,11 @@ static gint conv_jistoeuc(gchar *outbuf, gint outlen, const gchar *inbuf)
 	gchar *out = outbuf;
 	JISState state = JIS_ASCII;
 
-	while (*in != '\0' && (out - outbuf) < outlen - 3) {
+	/*
+	 * Loop outputs up to 3 bytes in each pass (aux kanji) and we
+	 * need 1 byte to terminate the output
+	 */
+	while (*in != '\0' && (out - outbuf) < outlen - 4) {
 		if (*in == ESC) {
 			in++;
 			if (*in == '$') {
@@ -294,7 +298,12 @@ static gint conv_euctojis(gchar *outbuf, gint outlen, const gchar *inbuf)
 	gchar *out = outbuf;
 	JISState state = JIS_ASCII;
 
-	while (*in != '\0' && (out - outbuf) < outlen - 3) {
+	/*
+	 * Loop outputs up to 6 bytes in each pass (aux shift + aux
+	 * kanji) and we need up to 4 bytes to terminate the output
+	 * (ASCII shift + null)
+	 */
+	while (*in != '\0' && (out - outbuf) < outlen - 10) {
 		if (IS_ASCII(*in)) {
 			K_OUT();
 			*out++ = *in++;
@@ -382,6 +391,10 @@ static gint conv_sjistoeuc(gchar *outbuf, gint outlen, const gchar *inbuf)
 	const guchar *in = inbuf;
 	gchar *out = outbuf;
 
+	/*
+	 * Loop outputs up to 2 bytes in each pass and we need 1 byte
+	 * to terminate the output
+	 */
 	while (*in != '\0' && (out - outbuf) < outlen - 3) {
 		if (IS_ASCII(*in)) {
 			*out++ = *in++;
diff --git a/src/gtk/authors.h b/src/gtk/authors.h
@@ -165,6 +165,7 @@ static char *CONTRIBS_LIST[] = {
 "Michael Hughes",
 "Richard Hughes",
 "Arthur Huillet",
+"Ben Hutchings",
 "Chideok Hwang",
 "John E.P. Hynes",
 "Hironori IWANE",