# since asian character sets use at least twice the number of bytes # for one character, it often happens that such encoded strings are # also twice as long as RFC 1522/2047 say. It's not that dangerous to # accept double-lengh strings since it does not change the semantics, # and the only user, rfc1522_decode uses this function only to validate # the input buffer and copying is done carefully, ensuring that it does # not overflow. --- pine4.59.9z/pine/strings.c +++ pine4.59.9d/pine/strings.c @@ -3052,7 +3052,7 @@ char **)); int rfc1522_valtok PROTO((int)); int rfc1522_valenc PROTO((int)); -int rfc1522_valid PROTO((char *, char **, char **, char **, +int rfc1522_valid PROTO((char *, int, char **, char **, char **, char **)); char *rfc1522_8bit PROTO((void *, int)); char *rfc1522_binary PROTO((void *, int)); @@ -3273,10 +3646,14 @@ int /* * rfc1522_valid - validate the given string as to it's rfc1522-ness + * if relaxchk is true, double the maximum length of an encoded word. + * this is necessary to decode overlong encoded words generated by + * numerous non-compliant implementations of RFC 2047 (1522). */ int -rfc1522_valid(s, charset, enc, txt, endp) +rfc1522_valid(s, relaxchk, charset, enc, txt, endp) char *s; + int relaxchk; char **charset; char **enc; char **txt; @@ -3294,7 +3671,11 @@ rfc1522_valid(s, charset, enc, txt, endp rv = rfc1522_token(c = s+RFC1522_INIT_L, rfc1522_valtok, RFC1522_DLIM, &e) && rfc1522_token(++e, rfc1522_valtok, RFC1522_DLIM, &t) && rfc1522_token(++t, rfc1522_valenc, RFC1522_TERM, &p) - && p - s <= RFC1522_MAXW; + && p - s <= RFC1522_MAXW * (relaxchk ? 2 : 1); + /* + * relax the length condition by doubling the max length of an + * encoded word. It's is needed for some longer encoded words. + */ if(charset) *charset = c; @@ -3345,7 +3726,7 @@ rfc1522_encode(d, len, s, charset) } else if(*p == RFC1522_INIT[0] && !strncmp((char *) p, RFC1522_INIT, RFC1522_INIT_L)){ - if(rfc1522_valid((char *) p, NULL, NULL, NULL, (char **) &q)) + if(rfc1522_valid((char *) p, 0, NULL, NULL, NULL, (char **) &q)) p = q + RFC1522_TERM_L - 1; /* advance past encoded gunk */ } else if(*p == ESCAPE && match_escapes((char *)(p+1))){