From 586a5180287262070637c8943f2f7efd652e4a2c Mon Sep 17 00:00:00 2001 From: Steven Morgan Date: Thu, 2 Mar 2017 14:41:20 -0500 Subject: [PATCH] bb11797 - fix invalid read in fuzzed mail file. --- libclamav/message.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/libclamav/message.c b/libclamav/message.c index b5cf0ddc7..36bbf417d 100644 --- a/libclamav/message.c +++ b/libclamav/message.c @@ -445,8 +445,12 @@ messageAddArgument(message *m, const char *arg) * FIXME: Bounce message handling is corrupting the in * core copies of headers */ - cli_dbgmsg("Possible data corruption fixed\n"); - p[8] = '='; + if (strlen(p) > 8) { + cli_dbgmsg("Possible data corruption fixed\n"); + p[8] = '='; + } else { + cli_dbgmsg("Possible data corruption not fixed\n"); + } } else { if(*p) cli_dbgmsg("messageAddArgument, '%s' contains no '='\n", p); @@ -682,7 +686,7 @@ messageFindArgument(const message *m, const char *variable) cli_dbgmsg("messageFindArgument: no '=' sign found in MIME header '%s' (%s)\n", variable, messageGetArgument(m, i)); return NULL; } - if((*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) { + if((strlen(ptr) > 2) && (*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) { /* Remove any quote characters */ char *ret = cli_strdup(++ptr); char *p;