From: Timo Sirainen <timo.sirainen@dovecot.fi>
Date: Mon, 17 Oct 2016 20:06:48 +0000 (+0300)
Subject: lib-mail: Fixed infinite loop in istream-attachment-extractor
X-Git-Tag: 2.2.26~120
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=da00d765f21394fd78af24a728eb7566935e7df6;p=thirdparty%2Fdovecot%2Fcore.git

lib-mail: Fixed infinite loop in istream-attachment-extractor

Broken by 7f74811b7. Pretty much any larger attachment going through
this istream had a good potential of going into an infinite loop.
---

diff --git a/src/lib-mail/istream-attachment-extractor.c b/src/lib-mail/istream-attachment-extractor.c
index 250507631e..0f1d8c65a2 100644
--- a/src/lib-mail/istream-attachment-extractor.c
+++ b/src/lib-mail/istream-attachment-extractor.c
@@ -375,7 +375,9 @@ static int astream_decode_base64(struct attachment_istream *astream)
 	o_stream_cork(output);
 
 	hash_format_reset(astream->set.hash_format);
-	while ((ret = i_stream_read_more(base64_input, &data, &size)) > 0) {
+	size_t bytes_needed = 1;
+	while ((ret = i_stream_read_bytes(base64_input, &data, &size,
+					  bytes_needed)) > 0) {
 		buffer_set_used_size(buf, 0);
 		if (base64_decode(data, size, &size, buf) < 0) {
 			i_error("istream-attachment: BUG: "
@@ -387,6 +389,7 @@ static int astream_decode_base64(struct attachment_istream *astream)
 		o_stream_nsend(output, buf->data, buf->used);
 		hash_format_loop(astream->set.hash_format,
 				 buf->data, buf->used);
+		bytes_needed = i_stream_get_data_size(base64_input) + 1;
 	}
 	if (ret != -1) {
 		i_assert(failed);