Fix segfault in invalid fast track uuencoded files

git-svn: trunk@1594

clamav-devel/ChangeLog

@@ -1,3 +1,7 @@
+Tue May 31 19:15:01 BST 2005 (njh)
+----------------------------------
+  * libclamav/mbox.c:	Fix mishandling of fast track uuencoded files
+
 Fri May 27 15:55:00 BST 2005 (njh)
 ----------------------------------
   * clamav-milter:	When loading a new database when not in external mode,

clamav-devel/libclamav/mbox.c

@@ -15,7 +15,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-static	char	const	rcsid[] = "$Id: mbox.c,v 1.245 2005/05/13 19:43:37 nigelhorne Exp $";
+static	char	const	rcsid[] = "$Id: mbox.c,v 1.246 2005/05/31 18:13:48 nigelhorne Exp $";
 
 #if HAVE_CONFIG_H
 #include "clamav-config.h"
@@ -187,7 +187,7 @@ static	char	*rfc822comments(const char *in, char *out);
 static	int	rfc1341(message *m, const char *dir);
 #endif
 static	bool	usefulHeader(int commandNumber, const char *cmd);
-static	void	uufasttrack(message *m, const char *firstline, const char *dir, FILE *fin);
+static	int	uufasttrack(message *m, const char *firstline, const char *dir, FILE *fin);
 static	char	*getline(char *buffer, size_t len, FILE *fin);
 
 static	void	checkURLs(message *m, const char *dir);
@@ -882,13 +882,15 @@ cli_parse_mbox(const char *dir, int desc, unsigned int options)
 			} else
 				lastLineWasEmpty = (bool)(buffer[0] == '\0');
 
-			if(isuuencodebegin(buffer))
+			if(isuuencodebegin(buffer)) {
 				/*
 				 * Fast track visa to uudecode.
 				 * TODO: binhex, yenc
 				 */
-				uufasttrack(m, buffer, dir, fd);
-			else
+				if(uufasttrack(m, buffer, dir, fd) < 0)
+					if(messageAddStr(m, buffer) < 0)
+						break;
+			} else
 				if(messageAddStr(m, buffer) < 0)
 					break;
 		} while(fgets(buffer, sizeof(buffer) - 1, fd) != NULL);
@@ -1155,13 +1157,15 @@ parseEmailFile(FILE *fin, const table_t *rfc821, const char *firstLine, const ch
 				free(fullline);
 				fullline = NULL;
 			}
-		} else if(line && isuuencodebegin(line))
+		} else if(line && isuuencodebegin(line)) {
 			/*
 			 * Fast track visa to uudecode.
 			 * TODO: binhex, yenc
 			 */
-			uufasttrack(ret, line, dir, fin);
-		else
+			if(uufasttrack(ret, line, dir, fin) < 0)
+				if(messageAddStr(ret, line) < 0)
+					break;
+		} else
 			if(messageAddStr(ret, line) < 0)
 				break;
 	} while(getline(buffer, sizeof(buffer) - 1, fin) != NULL);
@@ -1653,8 +1657,8 @@ parseEmailBody(message *messageIn, text *textIn, const char *dir, const table_t
 				do {
 					const char *line = lineGetData(t_line->t_line);
 
-					/*cli_dbgmsg("inMimeHead %d inhead %d boundary '%s' line '%s' next '%s'\n",
-						inMimeHead, inhead, boundary, line,
+					/*cli_dbgmsg("multipart %d: inMimeHead %d inhead %d boundary '%s' line '%s' next '%s'\n",
+						multiparts, inMimeHead, inhead, boundary, line,
 						t_line->t_next && t_line->t_next->t_line ? lineGetData(t_line->t_next->t_line) : "(null)");*/
 
 					if(inMimeHead) {	/* continuation line */
@@ -3826,14 +3830,18 @@ usefulHeader(int commandNumber, const char *cmd)
 /*
  * Save the uuencoded part of the file as it is read in since there's no need
  * to include it in the parse tree. Saves memory and parse time.
+ * Return < 0 for failure
  */
-static void
+static int
 uufasttrack(message *m, const char *firstline, const char *dir, FILE *fin)
 {
 	fileblob *fb = fileblobCreate();
 	char buffer[RFC2821LENGTH + 1];
 	char *filename = cli_strtok(firstline, 2, " ");
 
+	if(filename == NULL)
+		return -1;
+
 	fileblobSetFilename(fb, dir, filename);
 	cli_dbgmsg("Fast track uudecode %s\n", filename);
 	free(filename);
@@ -3862,6 +3870,8 @@ uufasttrack(message *m, const char *firstline, const char *dir, FILE *fin)
 	}
 
 	fileblobDestroy(fb);
+
+	return 1;
 }
 
 /*