]> git.ipfire.org Git - thirdparty/dovecot/core.git/commitdiff
lib-mail: Fixed infinite loop in istream-attachment-extractor
authorTimo Sirainen <timo.sirainen@dovecot.fi>
Mon, 17 Oct 2016 20:06:48 +0000 (23:06 +0300)
committerTimo Sirainen <timo.sirainen@dovecot.fi>
Mon, 17 Oct 2016 20:11:25 +0000 (23:11 +0300)
Broken by 7f74811b7. Pretty much any larger attachment going through
this istream had a good potential of going into an infinite loop.

src/lib-mail/istream-attachment-extractor.c

index 250507631e67a9e1455d3568fd63c2a0f4134a4b..0f1d8c65a2025562b6a3a002d9d903a813911fc4 100644 (file)
@@ -375,7 +375,9 @@ static int astream_decode_base64(struct attachment_istream *astream)
        o_stream_cork(output);
 
        hash_format_reset(astream->set.hash_format);
-       while ((ret = i_stream_read_more(base64_input, &data, &size)) > 0) {
+       size_t bytes_needed = 1;
+       while ((ret = i_stream_read_bytes(base64_input, &data, &size,
+                                         bytes_needed)) > 0) {
                buffer_set_used_size(buf, 0);
                if (base64_decode(data, size, &size, buf) < 0) {
                        i_error("istream-attachment: BUG: "
@@ -387,6 +389,7 @@ static int astream_decode_base64(struct attachment_istream *astream)
                o_stream_nsend(output, buf->data, buf->used);
                hash_format_loop(astream->set.hash_format,
                                 buf->data, buf->used);
+               bytes_needed = i_stream_get_data_size(base64_input) + 1;
        }
        if (ret != -1) {
                i_assert(failed);