Fix invalid pointer arithmetic.

[nmh] / sbr / fmt_rfc2047.c

diff --git a/sbr/fmt_rfc2047.c b/sbr/fmt_rfc2047.c
index 7013ceab8bd63f32887ae6eae22d7de83cc313a2..8c799e14c77b1197c684ab446c163df018c31b66 100644 (file)
--- a/sbr/fmt_rfc2047.c
+++ b/sbr/fmt_rfc2047.c
@@ -1,8 +1,4 @@
-
-/*
- * fmt_rfc2047.c -- decode RFC-2047 header format 
- *
- * $Id$
+/* fmt_rfc2047.c -- decode RFC-2047 header format 
  *
  * This code is Copyright (c) 2002, by the authors of nmh.  See the
  * COPYRIGHT file in the root directory of the nmh distribution for
@@ -13,10 +9,9 @@
 #include <h/utils.h>
 #ifdef HAVE_ICONV
 #  include <iconv.h>
-#  include <errno.h>
 #endif
 
-static signed char hexindex[] = {
+static const signed char hexindex[] = {
     -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
     -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
     -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
@@ -24,10 +19,18 @@ static signed char hexindex[] = {
     -1,10,11,12,13,14,15,-1,-1,-1,-1,-1,-1,-1,-1,-1,
     -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
     -1,10,11,12,13,14,15,-1,-1,-1,-1,-1,-1,-1,-1,-1,
+    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
+    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
+    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
+    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
+    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
+    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
+    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
+    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
     -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1
 };
 
-static signed char index_64[128] = {
+static const signed char index_64[128] = {
     -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,-1,
     -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,-1,
     -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,62, -1,-1,-1,63,
@@ -40,12 +43,16 @@ static signed char index_64[128] = {
 
 #define char64(c) (((unsigned char) (c) > 127) ? -1 : index_64[(unsigned char) (c)])
 
-static int
-unqp (unsigned char byte1, unsigned char byte2)
+/*
+ * Decode two quoted-pair characters
+ */
+
+int
+decode_qp (unsigned char byte1, unsigned char byte2)
 {
     if (hexindex[byte1] == -1 || hexindex[byte2] == -1)
        return -1;
-    return (hexindex[byte1] << 4 | hexindex[byte2]);
+    return hexindex[byte1] << 4 | hexindex[byte2];
 }
 
 /* Check if character is linear whitespace */
@@ -63,7 +70,7 @@ int
 decode_rfc2047 (char *str, char *dst, size_t dstlen)
 {
     char *p, *q, *pp;
-    char *startofmime, *endofmime;
+    char *startofmime, *endofmime, *endofcharset;
     int c, quoted_printable;
     int encoding_found = 0;    /* did we decode anything?                */
     int between_encodings = 0; /* are we between two encodings?          */
@@ -71,7 +78,7 @@ decode_rfc2047 (char *str, char *dst, size_t dstlen)
     int whitespace = 0;                /* how much whitespace between encodings? */
 #ifdef HAVE_ICONV
     int use_iconv = 0;          /* are we converting encoding with iconv? */
-    iconv_t cd;
+    iconv_t cd = NULL;
     int fromutf8 = 0;
     char *saveq, *convbuf = NULL;
     size_t savedstlen;
@@ -119,7 +126,7 @@ decode_rfc2047 (char *str, char *dst, size_t dstlen)
        equals_pending = 1;     /* we have a '=' pending */
 
        /* Check for initial =? */
-       if (*p == '=' && p[1] && p[1] == '?' && p[2]) {
+       if (*p == '=' && p[1] == '?' && p[2]) {
            startofmime = p + 2;
 
            /* Scan ahead for the next '?' character */
@@ -129,11 +136,25 @@ decode_rfc2047 (char *str, char *dst, size_t dstlen)
            if (!*pp)
                continue;
 
+           /*
+            * RFC 2231 specifies that language information can appear
+            * in a charset specification like so:
+            *
+            * =?us-ascii*en?Q?Foo?=
+            *
+            * Right now we don't use language information, so ignore it.
+            */
+
+           for (endofcharset = startofmime;
+                       *endofcharset != '*' && endofcharset < pp;
+                                                       endofcharset++)
+               ;
+
            /* Check if character set can be handled natively */
-           if (!check_charset(startofmime, pp - startofmime)) {
+           if (!check_charset(startofmime, endofcharset - startofmime)) {
 #ifdef HAVE_ICONV
                /* .. it can't. We'll use iconv then. */
-               *pp = '\0';
+               *endofcharset = '\0';
                cd = iconv_open(get_charset(), startofmime);
                fromutf8 = !strcasecmp(startofmime, "UTF-8");
                *pp = '?';
@@ -168,9 +189,9 @@ decode_rfc2047 (char *str, char *dst, size_t dstlen)
             */
            endofmime = NULL;
            for (pp = startofmime; *pp && *(pp+1); pp++) {
-               if (is_lws(*pp)) {
+               if (is_lws(*pp))
                    break;
-               } else if (*pp == '?' && pp[1] == '=') {
+               if (*pp == '?' && pp[1] == '=') {
                    endofmime = pp;
                    break;
                }
@@ -200,7 +221,7 @@ decode_rfc2047 (char *str, char *dst, size_t dstlen)
             * empty encoded text. This ensures that we don't
             * malloc 0 bytes but skip on to the end
             */
-           if (endofmime == startofmime) {
+           if (endofmime == startofmime && use_iconv) {
                use_iconv = 0;
                iconv_close(cd);
             }
@@ -208,7 +229,7 @@ decode_rfc2047 (char *str, char *dst, size_t dstlen)
            if (use_iconv) {
                saveq = q;
                savedstlen = dstlen;
-                q = convbuf = (char *) mh_xmalloc(endofmime - startofmime);
+                q = convbuf = mh_xmalloc(endofmime - startofmime);
             }
 /* ADDCHR2 is for adding characters when q is or might be convbuf:
  * in this case on buffer-full we want to run iconv before returning.
@@ -223,7 +244,7 @@ decode_rfc2047 (char *str, char *dst, size_t dstlen)
            if (quoted_printable) {
                for (pp = startofmime; pp < endofmime; pp++) {
                    if (*pp == '=') {
-                       c = unqp (pp[1], pp[2]);
+                       c = decode_qp (pp[1], pp[2]);
                        if (c == -1)
                            continue;
                        if (c != 0)
@@ -238,6 +259,7 @@ decode_rfc2047 (char *str, char *dst, size_t dstlen)
            } else {
                /* base64 */
                int c1, c2, c3, c4;
+               c1 = c2 = c3 = c4 = -1;
 
                pp = startofmime;
                while (pp < endofmime) {
@@ -304,8 +326,10 @@ decode_rfc2047 (char *str, char *dst, size_t dstlen)
                            break;
                        /* skip to next input character */
                        if (fromutf8) {
-                           for (start++;(start < q) && ((*start & 192) == 128);start++)
-                               inbytes--;
+                           for (++start, --inbytes;
+                                start < q  &&  (*start & 192) == 128;
+                                ++start, --inbytes)
+                               continue;
                        } else
                            start++, inbytes--;
                        if (start >= q)