lib-smtp: smtp-command-parser - Fix read past buffer limit while parsing UTF-8 character.

The buffer limit was specified as (buf->pos - buf->end) rather than (buf->end -
buf->pos). Since at most a valid UTF-8 character can be read beyond the buffer
size, this bug didn't cause noticeable effects, nor does it present an attack
surface.

diff --git a/src/lib-smtp/smtp-command-parser.c b/src/lib-smtp/smtp-command-parser.c
index 3c4860c0a25288dbe522f750ac44103fc64ce290..f60461e8d1421107e094764dc55fab4d28f1b04b 100644 (file)
--- a/src/lib-smtp/smtp-command-parser.c
+++ b/src/lib-smtp/smtp-command-parser.c
@@ -180,7 +180,7 @@ static int smtp_command_parse_parameters(struct smtp_command_parser *parser)
                if (parser->auth_response)
                        ch = *p;
                else {
-                       nch = uni_utf8_get_char_n(p, (size_t)(p - parser->end),
+                       nch = uni_utf8_get_char_n(p, (size_t)(parser->end - p),
                                                  &ch);
                }
                if (nch == 0)