Wed 21 Jul 2004 07:44:58 PM UTC, original submission:
I was innocently attempting to read email today and was unable to
`inc` my mail--getting a core dump. After jumping through many many
hoops so that I could debug the problem, I discovered that there was a
bug in matchc() which could cause ill-formatted email to overrun
buffers. I don't think it could be abused to execute arbitrary
commands, at least in the context I saw it operating, but I hope you
agree that it must be fixed ASAP regardless.
The specific bug is that matchc() only checks to see if the string
being searched is out of bounds when the character in the search
string is NOT the first character of the pattern:
m_getfld.c: 730
for(;;)
while (pc != *str++)
if (str > es)
return 0;
The implication is if the search string ends with a lot of these
pattern characters, it will happily run past the end (es). If, as it
happened in my case, the pattern does happen to appear after es, the
function will return an address greater than es. This larger address
will be used for a length computation (m_getfld.c: 446) passed into
memcpy (m_getfld.c: 486), and will thus overrun the destination
buffer.
Changing the test so that it always tests str > es fixed the bug. I
did a little dance with where the increment occurs to prevent the
logic from being any more complex than necessary. I'll actually
provide two patches below. One minimal, one more clean (IMHO of course).
|