net-mail/cyrus-imap-admin/files/imap-overflow.diff


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

diff -urN cyrus-imapd-2.1.10/imap/imapparse.c cyrus-imapd-2.1.10-modified/imap/imapparse.c
--- cyrus-imapd-2.1.10/imap/imapparse.c	2002-12-03 17:08:02.000000000 -0600
+++ cyrus-imapd-2.1.10-modified/imap/imapparse.c	2002-12-03 17:45:52.000000000 -0600
@@ -97,7 +97,7 @@
 	       struct buf *buf, int type)
 {
     int c;
-    int i;
+    unsigned int i;
     unsigned int len = 0;
     int sawdigit = 0;
     int isnowait;
@@ -228,6 +228,16 @@
 	    if (c != EOF) prot_ungetc(c, pin);
 	    return EOF;
 	}
+	if (len > 65536) {
+	    if (isnowait) {
+	        for (i = 0; i < len; i++)
+	            c = prot_getc(pin);
+	    }
+	    prot_printf(pout, "* BAD Literal too large\r\n");
+	    prot_flush(pout);
+	    if (c != EOF) prot_ungetc(c, pin);
+	    return EOF;
+	}
 	if (len >= buf->alloc) {
 	    buf->alloc = len+1;
 	    buf->s = xrealloc(buf->s, buf->alloc+1);