From: Victor Julien <victor@inliniac.net>
Date: Thu, 21 Apr 2016 13:14:45 +0000 (+0200)
Subject: smtp/mime: allow unquoted name/filename fields
X-Git-Tag: suricata-3.1RC1~235
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=19d112ba077cae4d79beb5f4944ec78a0a69f8fd;p=thirdparty%2Fsuricata.git

smtp/mime: allow unquoted name/filename fields

Don't enforce that name/filename fields are quoted.

Reported-By: Blair Steven
---

diff --git a/src/util-decode-mime.c b/src/util-decode-mime.c
index 81d8bc720b..60206c20e3 100644
--- a/src/util-decode-mime.c
+++ b/src/util-decode-mime.c
@@ -1891,7 +1891,7 @@ static int ProcessMimeHeaders(const uint8_t *buf, uint32_t len,
         /* Check for file attachment in content disposition */
         field = MimeDecFindField(entity, CTNT_DISP_STR);
         if (field != NULL) {
-            bptr = FindMimeHeaderToken(field, "filename=\"", TOK_END_STR, &blen);
+            bptr = FindMimeHeaderToken(field, "filename=", TOK_END_STR, &blen);
             if (bptr != NULL) {
                 SCLogDebug("File attachment found in disposition");
                 entity->ctnt_flags |= CTNT_IS_ATTACHMENT;
@@ -1933,7 +1933,7 @@ static int ProcessMimeHeaders(const uint8_t *buf, uint32_t len,
 
             /* Look for file name (if not already found) */
             if (!(entity->ctnt_flags & CTNT_IS_ATTACHMENT)) {
-                bptr = FindMimeHeaderToken(field, "name=\"", TOK_END_STR, &blen);
+                bptr = FindMimeHeaderToken(field, "name=", TOK_END_STR, &blen);
                 if (bptr != NULL) {
                     SCLogDebug("File attachment found");
                     entity->ctnt_flags |= CTNT_IS_ATTACHMENT;