talons

commit 0c021062d1ba763d57f37777cfe2e2119d3264ef
parent f6c690e3c9928eb3694c033ee081fecb2e57a4a1
Author: Andrej Kacian <ticho@claws-mail.org>
Date:   Mon,  8 May 2017 01:09:53 +0200

Fix crash in mailimf_group_parse() in mailmbox plugin.

Fix based on upstream fix:
https://github.com/dinhviethoa/libetpan/commit/1fe8fb

Fixes our bug #3821:
Potential security issue with libetpan code in mailmbox plugin

Diffstat:
M
src/plugins/mailmbox/mailimf.c
 | 
12
++++++++++++

1 file changed, 12 insertions(+), 0 deletions(-)
diff --git a/src/plugins/mailmbox/mailimf.c b/src/plugins/mailmbox/mailimf.c
@@ -2984,6 +2984,7 @@ static int mailimf_group_parse(const char * message, size_t length,
   struct mailimf_group * group;
   int r;
   int res;
+  clist * list;
 
   cur_token = * index;
 
@@ -3011,6 +3012,17 @@ static int mailimf_group_parse(const char * message, size_t length,
       res = r;
       goto free_display_name;
     }
+    list = clist_new();
+    if (list == NULL) {
+      res = MAILIMF_ERROR_MEMORY;
+      goto free_display_name;
+    }
+    mailbox_list = mailimf_mailbox_list_new(list);
+    if (mailbox_list == NULL) {
+      res = MAILIMF_ERROR_MEMORY;
+      clist_free(list);
+      goto free_display_name;
+    }
     break;
   default:
     res = r;