Commit 6895c8da authored by Rob Swindell's avatar Rob Swindell 💬
Browse files

Fix heap corruption of qp_decode()

qp_decode (quoted-printable in-place decode of a string) could write 2 characters *beyond* the allocated buffer by appending "\r\n" to a string that was not quoted-printable in the first place. i.e. the  contents of buf were not actually changed in the decode loop. This could result in a corrupted heap and crash of sbbs or smbutil when reading such a message.

This change may result in a lack of CRLF appended to decoded plain text output, so we'll have to keep an eye out for that and resolve it some other way. One possibility could be to only append the CRLF if the destination pointer is sufficiently behind the source pointer.

This solves the crash that Kirkman reported with a specific message in his "mail" base. The header for the message said it was quoted-printable encoded, but the body text was not actually encoded at all:
OtherHeader      Content-Type: text/plain; charset="iso-8859-1"
OtherHeader      MIME-Version: 1.0
OtherHeader      Content-Transfer-Encoding: quoted-printable
parent 3503816f
Pipeline #2889 passed with stage
in 10 minutes and 5 seconds
......@@ -247,8 +247,6 @@ char* qp_decode(char* buf)
return buf;
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment