Unverified Commit 8dd4edeb authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

smtp/pop3/imap_get_message: decrease the data length too... 

Follow-up commit to 615edc1f which was incomplete.

Assisted-by: Max Dymond
Detected by OSS-fuzz
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5206
parent 84fcaa2e

lib/imap.c

+5 −3
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ 
 *                            | (__| |_| |  _ <| |___

 *                             \___|\___/|_| \_\_____|

 *

 * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.

 * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.

 *

 * This software is licensed as described in the file COPYING, which

 * you should have received as part of this distribution. The terms
@@ -349,11 +349,13 @@ static void imap_get_message(char *buffer, char **outptr) 


  if(len > 2) {

    /* Find the start of the message */

    for(message = buffer + 2; *message == ' ' || *message == '\t'; message++)

    len -= 2;

    for(message = buffer + 2; *message == ' ' || *message == '\t';

        message++, len--)

      ;



    /* Find the end of the message */

    for(len -= 2; len--;)

    for(; len--;)

      if(message[len] != '\r' && message[len] != '\n' && message[len] != ' ' &&

         message[len] != '\t')

        break;

lib/pop3.c

+5 −3
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ 
 *                            | (__| |_| |  _ <| |___

 *                             \___|\___/|_| \_\_____|

 *

 * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.

 * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.

 *

 * This software is licensed as described in the file COPYING, which

 * you should have received as part of this distribution. The terms
@@ -248,11 +248,13 @@ static void pop3_get_message(char *buffer, char **outptr) 


  if(len > 2) {

    /* Find the start of the message */

    for(message = buffer + 2; *message == ' ' || *message == '\t'; message++)

    len -= 2;

    for(message = buffer + 2; *message == ' ' || *message == '\t';

        message++, len--)

      ;



    /* Find the end of the message */

    for(len -= 2; len--;)

    for(; len--;)

      if(message[len] != '\r' && message[len] != '\n' && message[len] != ' ' &&

         message[len] != '\t')

        break;

lib/smtp.c

+5 −3
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ 
 *                            | (__| |_| |  _ <| |___

 *                             \___|\___/|_| \_\_____|

 *

 * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.

 * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.

 *

 * This software is licensed as described in the file COPYING, which

 * you should have received as part of this distribution. The terms
@@ -237,11 +237,13 @@ static void smtp_get_message(char *buffer, char **outptr) 


  if(len > 4) {

    /* Find the start of the message */

    for(message = buffer + 4; *message == ' ' || *message == '\t'; message++)

    len -= 4;

    for(message = buffer + 4; *message == ' ' || *message == '\t';

        message++, len--)

      ;



    /* Find the end of the message */

    for(len -= 4; len--;)

    for(; len--;)

      if(message[len] != '\r' && message[len] != '\n' && message[len] != ' ' &&

         message[len] != '\t')

        break;