talons

commit 881c83459ea5ac52b30030dabdc0a8490e7554f8
parent 11046472fe18fcdcc8c12b131f58c26120f1a428
Author: Andrej Kacian <ticho@claws-mail.org>
Date:   Sat, 24 Nov 2018 23:14:26 +0100

Mailmbox: fix buffer overflow in mailimf_get_message_id().

The compiler warning was:

mailimf_types_helper.c: In function ‘mailimf_get_message_id’:
mailimf_types_helper.c:1270:51: warning: ‘%s’ directive output may be truncated writing up to 511 bytes into a region of size between 463 and 500 [-Wformat-truncation=]
   snprintf(id, MAX_MESSAGE_ID, "etPan.%llx.%lx.%x@%s",
                                                   ^~
     (long long)now, value, getpid(), name);
                                      ~~~~
mailimf_types_helper.c:1270:3: note: ‘snprintf’ output between 13 and 561 bytes into a destination of size 512
   snprintf(id, MAX_MESSAGE_ID, "etPan.%llx.%lx.%x@%s",
   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     (long long)now, value, getpid(), name);
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Diffstat:
M
src/plugins/mailmbox/mailimf_types_helper.c
 | 
16
++++++++++++++--

1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/src/plugins/mailmbox/mailimf_types_helper.c b/src/plugins/mailmbox/mailimf_types_helper.c
@@ -35,6 +35,8 @@
 #include <string.h>
 #include <time.h>
 #include <unistd.h>
+#include <limits.h>
+#include <errno.h>
 
 #include "mailimf.h"
 
@@ -1260,13 +1262,23 @@ char * mailimf_get_message_id(void)
 {
   char id[MAX_MESSAGE_ID];
   time_t now;
-  char name[MAX_MESSAGE_ID];
+  char name[HOST_NAME_MAX];
   long value;
+	int ret;
 
   now = time(NULL);
   value = random();
 
-  gethostname(name, MAX_MESSAGE_ID);
+	/* It's unlikely that HOST_NAME_MAX goes above 64, but let's
+	 * leave a generous reserve for the hostname in the message
+	 * id string. */
+  if (HOST_NAME_MAX > MAX_MESSAGE_ID - 64 ||
+			(ret = gethostname(name, HOST_NAME_MAX)) != 0) {
+		if (ret != 0)
+			perror("gethostname");
+		strncpy(name, "unknown", HOST_NAME_MAX);
+	}
+
   snprintf(id, MAX_MESSAGE_ID, "etPan.%llx.%lx.%x@%s",
 	   (long long)now, value, getpid(), name);