Fixed invalid read in cleanquotedp()

diff --git a/ChangeLog b/ChangeLog
index c8c4c1844af226d912c4570348a3c58c8081d6c8..a8665495f1460e2c75f4272dfc0d197d6db19bfa 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,4 @@
+ o Fixed invalid read in cleanquotedp()
  o Fixed bug in gethdrline() introduced in 1.2.12-RC3
 1.2.12-RC4
  o Fixed memory leak in checkwait_smtpreply()

diff --git a/src/strgen.c b/src/strgen.c
index 9121f4c309b6b27bac19959c1bdbfcbe9427a6a8..ed97f5f13ef59ccb6d3ddea9a81284d746f687f2 100644 (file)
--- a/src/strgen.c
+++ b/src/strgen.c
@@ -29,6 +29,7 @@
 #include <netdb.h>
 #include <libgen.h>
 #include <time.h>
+#include <ctype.h>
 
 #include "strgen.h"
 #include "wrappers.h"
@@ -194,12 +195,16 @@ char *cleanquotedp(const char *qpstr)
        retstr = mymalloc(len + 1);
        retstr[len] = '\0';
        qc[2] = '\0';
-       while(*c != '\0') {
+       while(c < qpstr+len) {
                switch(*c) {
                        case '=':
-                               qc[0] = *(++c);
-                               qc[1] = *(++c);
                                c++;
+                               if (!isxdigit(*c))
+                                       break;
+                               qc[0] = *(c++);
+                               if (!isxdigit(*c))
+                                       break;
+                               qc[1] = *(c++);
                                qcval = strtol(qc, NULL, 16);
                                if(qcval)
                                        retstr[i++] = (char)qcval;