The latest patch to this function introduced a bug: it will not grow the
buffer, which results in truncated reads.  Should be easy to reproduce
with DELTA set to 5 or similar.  I noticed this when logging in with
GS2-KRB5 which has pretty long lines:

Mar 17 17:14:07 mocca imap4d[23755]: recv: 
biwsAQBuggHMMIIByKADAgEFoQMCAQ6iBwMFACAAAACjgeVhgeIwgd+gAwIBBaEHGwVtb2NjYaIYMBagAwIBAaEPMA0bBGltYXAbBW1vY2Nho4G0MIGxoAMCARKigak
Mar 17 17:14:07 mocca imap4d[23755]: GSASL error: Base 64 coding error in SASL 
library
Mar 17 17:14:07 mocca imap4d[23755]: sent: . NO AUTHENTICATE GS2-KRB5 
authentication failed
Mar 17 17:14:07 mocca imap4d[23755]: recv: 
EgaY6lEmmmLIiEJM1vLfTqFiirwZBvgx/Q3WRhqb/GLqAq8ik44qIotMPmQLvQtn5A+GtfBeMulh+YJ9rzkwE/kHWnL0WuDRD6l8cBT7rtWhXK5d7VECZDQVaddCD/5hgX/Sq+S49DuWDQhxFb6fJkLWB60OuVnXDAHrpQKqwXQCANwDli5BdwJisEsDjhTbabLJ13Ces2d0DLW9J/IyI78A7Rlom5WkwpIHKMIHHoAMCARKigb8Egby7qNiPgPD6HEqvthsjrewiEkTfpTMl44zkIvPI3cBYlncJH7rkPjWCM+CeKjH09rECRAaaOe236/8dd3YpWC38SPtpri5LGGjsJfoGPWGm9lGKkm6Puhn/3L3clv8qZq5dhzSfbCq5tXiLkmLw4XLefocZ0KSU6dpBfWNWEqzn9BpUxtYBizcyRabyJJzfvsMI12gzrxO/E74WcDM9G5kssfbIjIBcqh3cYlVidVjQd7yM2jGzlbeHAib8/Q==

The client sent both base64 tokens on one line, concatenated.  The
truncation offset is the DELTA boundary.

I've fixed it locally by reverting the part of the patch inside
mu_stream_getline like this

-      if (off == bufsize)
+      if (off + 1 == bufsize)

although the logic may needs to be double checked.

/Simon


_______________________________________________
Bug-mailutils mailing list
[email protected]
http://lists.gnu.org/mailman/listinfo/bug-mailutils

Reply via email to