wmbiff: Manually copy mailbox path.

Patch by Demi <m@tfiu.de> to fix Debian bug #621690.

From https://bugs.debian.org/621690:

> wmbiff change path of my mailboxes next nearest.
>
> For example wmbiff change 'gleb' to 'glil' for second and fourth mailboxes.
> However the 1st, 3rd and 5th mailboxes have correct path.

Well, the indices don't really enter.  I'm actually surprised this
isn't more trouble.

The underlying reason is that in wmbiff.c:parse_mbox_path, the
program calls

  mboxCreate((&mbox[item]), mbox[item].path);

which for maildirs calls

  int maildirCreate(Pop3 pc, const char *str)

in maildirClient.c.  str in this way is an alias for pc->path.

In maildirCreate, after some char acrobatics, the program eventually
does

  strncpy(pc->path, str + 8 + i, BUF_BIG - 1);

to cut off the leading stuff from the maildir.  The result of this
operation is not defined, as pc->path and str point to the same
memory and thus the arguments overlap, which strncpy outlaws.

A simple fix is to copy manually, like this:

		DM(pc, DEBUG_ERROR, "maildir '%s' is too long.\n", str + 8 + i);
		memset(pc->path, 0, BUF_BIG);
	} else {
+		const char *sp = str + 8 + i;
+		char *dp = pc->path;
+
+		while (*sp && sp-str<BUF_BIG-1) {
+			*dp++ = *sp++;
+		}
+		*dp = 0;
-		strncpy(pc->path, , BUF_BIG - 1);	/* cut off ``maildir:'' */
	}

-- it's what I'm doing now.  But I give you that's a bit pedestrian.
This commit is contained in:
Doug Torrance 2017-06-24 10:56:19 -04:00 committed by Carlos R. Mafra
parent 24c0e4e4f2
commit 3b000774cc

View file

@ -168,7 +168,13 @@ int maildirCreate(Pop3 pc, const char *str)
DM(pc, DEBUG_ERROR, "maildir '%s' is too long.\n", str + 8 + i);
memset(pc->path, 0, BUF_BIG);
} else {
strncpy(pc->path, str + 8 + i, BUF_BIG - 1); /* cut off ``maildir:'' */
const char *sp = str + 8 + i;
char *dp = pc->path;
while (*sp && sp-str<BUF_BIG-1) {
*dp++ = *sp++;
}
*dp = 0;
}
DM(pc, DEBUG_INFO, "maildir: str = '%s'\n", str);