43c781a116
Daniel Stenberg
2025-12-09
Subject
imap: check buffer length before accessing it
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/imap.c+3 -3
| @@ -1308,13 +1308,13 @@ static CURLcode imap_state_select_resp(struct Curl_easy *data, | |
| imapstate instate) | |
| { | |
| CURLcode result = CURLE_OK; | |
| - | const char *line = curlx_dyn_ptr(&imapc->pp.recvbuf); |
| - | |
| (void)instate; | |
| if(imapcode == '*') { | |
| /* See if this is an UIDVALIDITY response */ | |
| - | if(checkprefix("OK [UIDVALIDITY ", line + 2)) { |
| + | const char *line = curlx_dyn_ptr(&imapc->pp.recvbuf); |
| + | size_t len = curlx_dyn_len(&imapc->pp.recvbuf); |
| + | if((len >= 18) && checkprefix("OK [UIDVALIDITY ", &line[2])) { |
| curl_off_t value; | |
| const char *p = &line[2] + strlen("OK [UIDVALIDITY "); | |
| if(!curlx_str_number(&p, &value, UINT_MAX)) { | |