ap: Fix write past end of addrs[] array.

[nmh] / sbr / m_getfld.c

diff --git a/sbr/m_getfld.c b/sbr/m_getfld.c
index 1a1411eb08e0b627213c646eb2f3411231bdcaf6..5c5b4a3a88274646175e993af895e64593bd5282 100644 (file)
--- a/sbr/m_getfld.c
+++ b/sbr/m_getfld.c
@@ -159,7 +159,7 @@
    names are typically short (~8 char) and the loop that extracts them
    might terminate on a colon, newline or max width.  I considered
    using a Vax "scanc" to locate the end of the field followed by a
    names are typically short (~8 char) and the loop that extracts them
    might terminate on a colon, newline or max width.  I considered
    using a Vax "scanc" to locate the end of the field followed by a

-   "bcopy" but the routine call overhead on a Vax is too large for this
+   "memmove" but the routine call overhead on a Vax is too large for this

    to work on short names.  If Berkeley ever makes "inline" part of the
    C optimiser (so things like "scanc" turn into inline instructions) a
    change here would be worthwhile.
    to work on short names.  If Berkeley ever makes "inline" part of the
    C optimiser (so things like "scanc" turn into inline instructions) a
    change here would be worthwhile.


@@ -175,7 +175,7 @@
    so message bodies average at least a few hundred characters.
    Assuming your system uses reasonably sized stdio buffers (1K or
    more), this routine should be able to remove the body in large
    so message bodies average at least a few hundred characters.
    Assuming your system uses reasonably sized stdio buffers (1K or
    more), this routine should be able to remove the body in large

-   (>500 byte) chunks.  The makes the cost of a call to "bcopy"
+   (>500 byte) chunks.  The makes the cost of a call to "memmove"

    small but there is a premium on checking for the eom in packed
    maildrops.  The eom pattern is always a simple string so we can
    construct an efficient pattern matcher for it (e.g., a Vax "matchc"
    small but there is a premium on checking for the eom in packed
    maildrops.  The eom pattern is always a simple string so we can
    construct an efficient pattern matcher for it (e.g., a Vax "matchc"


@@ -581,6 +581,9 @@ m_getfld (m_getfld_state_t *gstate, char name[NAMESZ], char *buf, int *bufsz,
                memcpy (buf, name, n - 1);
                buf[n - 1] = '\n';
                buf[n] = '\0';
                memcpy (buf, name, n - 1);
                buf[n - 1] = '\n';
                buf[n] = '\0';

+                /* Indicate this wasn't a header field using a character
+                   that can't appear in a header field. */
+                name[0] = ':';

                /* The last character read was '\n'.  s->bytes_read
                   (and n) include that, but it was not put into the
                   name array in the for loop above.  So subtract 1. */
                /* The last character read was '\n'.  s->bytes_read
                   (and n) include that, but it was not put into the
                   name array in the for loop above.  So subtract 1. */


@@ -658,6 +661,7 @@ m_getfld (m_getfld_state_t *gstate, char name[NAMESZ], char *buf, int *bufsz,
             */
            char *bp;
 
             */
            char *bp;
 

+            name[0] = '\0';

            max = *bufsz-1;
            /* Back up and store the current position. */
            bp = --s->readpos;
            max = *bufsz-1;
            /* Back up and store the current position. */
            bp = --s->readpos;