lib-mail: html2text - Fix buffer out-of-bounds access

The passed in buffer size is at least 1 byte shorter than the actual buffer
size, therefore there is no chance of a crash.

diff --git a/src/lib-mail/mail-html2text.c b/src/lib-mail/mail-html2text.c
index 3d9f9beb4f8455dca6f229571c59aab6a1afb6ab..d186f67661d9d96a1614dfe9515f39a455355f8d 100644 (file)
--- a/src/lib-mail/mail-html2text.c
+++ b/src/lib-mail/mail-html2text.c
@@ -87,7 +87,7 @@ parse_tag_name(struct mail_html2text *ht,
                return 8 + 1;
        }
 
-       if (size >= 10 && i_memcasecmp(data, "blockquote", 10) == 0 &&
+       if (size >= 11 && i_memcasecmp(data, "blockquote", 10) == 0 &&
            (HTML_WHITESPACE(data[10]) || data[10] == '>')) {
                ht->quote_level++;
                ht->state = HTML_STATE_TAG;