1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
From 5540e1b47ac043033e6661b4e04dcaf958db0110 Mon Sep 17 00:00:00 2001
From: Rolf Eike Beer <eike@sf-mail.de>
Date: Mon, 11 May 2020 18:55:11 +0200
Subject: [PATCH 1/4] fix signedness wraparound in substdio_put()
(CVE-2005-1515)
---
qmail.c | 2 +-
substdo.c | 14 ++++++++------
2 files changed, 9 insertions(+), 7 deletions(-)
diff --git a/qmail.c b/qmail.c
index 186c092..7c86a04 100644
--- a/qmail.c
+++ b/qmail.c
@@ -61,7 +61,7 @@ void qmail_fail(qq) struct qmail *qq;
qq->flagerr = 1;
}
-void qmail_put(qq,s,len) struct qmail *qq; char *s; int len;
+void qmail_put(qq,s,len) struct qmail *qq; char *s; unsigned int len;
{
if (!qq->flagerr) if (substdio_put(&qq->ss,s,len) == -1) qq->flagerr = 1;
}
diff --git a/substdo.c b/substdo.c
index fb616f7..bccf0d6 100644
--- a/substdo.c
+++ b/substdo.c
@@ -7,7 +7,7 @@ static int allwrite(op,fd,buf,len)
register int (*op)();
register int fd;
register char *buf;
-register int len;
+register unsigned int len;
{
register int w;
@@ -55,16 +55,18 @@ register int len;
int substdio_put(s,buf,len)
register substdio *s;
register char *buf;
-register int len;
+register unsigned int len;
{
- register int n;
+ register unsigned int n = s->n; /* how many bytes to write in next chunk */
- n = s->n;
- if (len > n - s->p) {
+ /* check if the input would fit in the buffer without flushing */
+ if (len > n - (unsigned int)s->p) {
if (substdio_flush(s) == -1) return -1;
/* now s->p == 0 */
if (n < SUBSTDIO_OUTSIZE) n = SUBSTDIO_OUTSIZE;
- while (len > s->n) {
+ /* as long as the remainder would not fit into s->x write it directly
+ * from buf to s->fd. */
+ while (len > (unsigned int)s->n) {
if (n > len) n = len;
if (allwrite(s->op,s->fd,buf,n) == -1) return -1;
buf += n;
--
2.26.1
|
