ap: Fix write past end of addrs[] array.

[nmh] / sbr / m_getfld.c

diff --git a/sbr/m_getfld.c b/sbr/m_getfld.c
index 2e1ed998791fd638d2fd381774e31505545b7527..5c5b4a3a88274646175e993af895e64593bd5282 100644 (file)
--- a/sbr/m_getfld.c
+++ b/sbr/m_getfld.c
@@ -159,7 +159,7 @@
    names are typically short (~8 char) and the loop that extracts them
    might terminate on a colon, newline or max width.  I considered
    using a Vax "scanc" to locate the end of the field followed by a
    names are typically short (~8 char) and the loop that extracts them
    might terminate on a colon, newline or max width.  I considered
    using a Vax "scanc" to locate the end of the field followed by a

-   "bcopy" but the routine call overhead on a Vax is too large for this
+   "memmove" but the routine call overhead on a Vax is too large for this

    to work on short names.  If Berkeley ever makes "inline" part of the
    C optimiser (so things like "scanc" turn into inline instructions) a
    change here would be worthwhile.
    to work on short names.  If Berkeley ever makes "inline" part of the
    C optimiser (so things like "scanc" turn into inline instructions) a
    change here would be worthwhile.


@@ -175,7 +175,7 @@
    so message bodies average at least a few hundred characters.
    Assuming your system uses reasonably sized stdio buffers (1K or
    more), this routine should be able to remove the body in large
    so message bodies average at least a few hundred characters.
    Assuming your system uses reasonably sized stdio buffers (1K or
    more), this routine should be able to remove the body in large

-   (>500 byte) chunks.  The makes the cost of a call to "bcopy"
+   (>500 byte) chunks.  The makes the cost of a call to "memmove"

    small but there is a premium on checking for the eom in packed
    maildrops.  The eom pattern is always a simple string so we can
    construct an efficient pattern matcher for it (e.g., a Vax "matchc"
    small but there is a premium on checking for the eom in packed
    maildrops.  The eom pattern is always a simple string so we can
    construct an efficient pattern matcher for it (e.g., a Vax "matchc"


@@ -463,19 +463,17 @@ static int
 Peek (m_getfld_state_t s) {
     if (s->end - s->readpos < 1  &&  read_more (s) == 0) {
         return EOF;
 Peek (m_getfld_state_t s) {
     if (s->end - s->readpos < 1  &&  read_more (s) == 0) {
         return EOF;

-    } else {
-        return s->readpos < s->end  ?  (unsigned char) *s->readpos  :  EOF;

     }
     }

+    return s->readpos < s->end  ?  (unsigned char) *s->readpos  :  EOF;

 }
 
 static int
 Ungetc (int c, m_getfld_state_t s) {
     if (s->readpos == s->msg_buf) {
        return EOF;
 }
 
 static int
 Ungetc (int c, m_getfld_state_t s) {
     if (s->readpos == s->msg_buf) {
        return EOF;

-    } else {
-       --s->bytes_read;
-       return *--s->readpos = (unsigned char) c;

     }
     }

+    --s->bytes_read;
+    return *--s->readpos = (unsigned char) c;

 }
 
 
 }
 
 


@@ -583,13 +581,17 @@ m_getfld (m_getfld_state_t *gstate, char name[NAMESZ], char *buf, int *bufsz,
                memcpy (buf, name, n - 1);
                buf[n - 1] = '\n';
                buf[n] = '\0';
                memcpy (buf, name, n - 1);
                buf[n - 1] = '\n';
                buf[n] = '\0';

+                /* Indicate this wasn't a header field using a character
+                   that can't appear in a header field. */
+                name[0] = ':';

                /* The last character read was '\n'.  s->bytes_read
                   (and n) include that, but it was not put into the
                   name array in the for loop above.  So subtract 1. */
                *bufsz = --s->bytes_read;  /* == n - 1 */
                leave_getfld (s);
                return s->state = BODY;
                /* The last character read was '\n'.  s->bytes_read
                   (and n) include that, but it was not put into the
                   name array in the for loop above.  So subtract 1. */
                *bufsz = --s->bytes_read;  /* == n - 1 */
                leave_getfld (s);
                return s->state = BODY;

-           } else if (max <= n) {
+           }
+            if (max <= n) {

                /* By design, the loop above discards the last character
                    it had read.  It's in c, use it. */
                *cp++ = c;
                /* By design, the loop above discards the last character
                    it had read.  It's in c, use it. */
                *cp++ = c;


@@ -659,6 +661,7 @@ m_getfld (m_getfld_state_t *gstate, char name[NAMESZ], char *buf, int *bufsz,
             */
            char *bp;
 
             */
            char *bp;
 

+            name[0] = '\0';

            max = *bufsz-1;
            /* Back up and store the current position. */
            bp = --s->readpos;
            max = *bufsz-1;
            /* Back up and store the current position. */
            bp = --s->readpos;