From fc5bc656507c0feec739b881388515760846ea23 Mon Sep 17 00:00:00 2001
From: Wolfgang Sourdeau <wsourdeau@inverse.ca>
Date: Tue, 13 Nov 2007 22:17:09 +0000
Subject: [PATCH] Monotone-Parent: 975e1acbb350fdff466553beb555d68abcc696b2
 Monotone-Revision: e31bc3f67d86e07aadb444cf91842d37e63716ae

Monotone-Author: wsourdeau@inverse.ca
Monotone-Date: 2007-11-13T22:17:09
Monotone-Branch: ca.inverse.sogo
---
 ChangeLog                                  |  4 ++
 UI/MailPartViewers/UIxMailPartTextViewer.m | 64 +++++++++++++++-------
 2 files changed, 49 insertions(+), 19 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 8cce529f3..95580463c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
 2007-11-13  Wolfgang Sourdeau  <wsourdeau@inverse.ca>
 
+	* UI/MailPartViewers/UIxMailPartTextViewer.m ([NSString
+	-stringByConvertingCRLNToHTML]): fixed crashes due to overflows in
+	temporary buffer we are handing.
+
 	* UI/Scheduler/UIxComponentEditor.m ([UIxComponentEditor
 	-setComponent:newComponent]): check that newComponent is non-nil
 	before replacing the default values.
diff --git a/UI/MailPartViewers/UIxMailPartTextViewer.m b/UI/MailPartViewers/UIxMailPartTextViewer.m
index 6e9b6a26a..27ecea507 100644
--- a/UI/MailPartViewers/UIxMailPartTextViewer.m
+++ b/UI/MailPartViewers/UIxMailPartTextViewer.m
@@ -28,6 +28,8 @@
   TODO: add contained link detection.
 */
 
+#import <Foundation/NSException.h>
+
 #import <NGExtensions/NSString+misc.h>
 
 #import <SoObjects/SOGo/NSString+Utilities.h>
@@ -42,35 +44,45 @@
 
 @implementation NSString (SOGoMailUIExtension)
 
-- (NSString *) stringByConvertingCRLNToHTML
+static inline char *
+convertChars (const char *oldString, unsigned int oldLength,
+	      unsigned int *newLength)
 {
-  NSString *convertedString;
-  const char *oldString, *currentChar;
-  char *newString, *destChar;
-  unsigned int oldLength, length, delta;
+  const char *currentChar, *upperLimit;
+  char *newString, *destChar, *reallocated;
+  unsigned int length, maxLength, iteration;
 
-  oldString = [self cStringUsingEncoding: NSUTF8StringEncoding];
-  oldLength = [self lengthOfBytesUsingEncoding: NSUTF8StringEncoding];
-
-  length = oldLength;
-  newString = malloc (length + 500);
+  maxLength = oldLength + 500;
+  newString = malloc (maxLength);
   destChar = newString;
   currentChar = oldString;
-  while (currentChar < (oldString + oldLength))
+
+  length = 0;
+  iteration = 0;
+
+  upperLimit = oldString + oldLength;
+  while ((unsigned int) currentChar < (unsigned int) upperLimit)
     {
       if (*currentChar != '\r')
 	{
 	  if (*currentChar == '\n')
 	    {
+	      length = (unsigned int) destChar - (unsigned int) newString;
+	      if ((length + (6 * iteration) + 500) > maxLength)
+		{
+		  maxLength = length + (iteration * 6) + 500;
+		  reallocated = realloc (newString, maxLength);
+		  if (reallocated)
+		    newString = reallocated;
+		  else
+		    [NSException raise: NSMallocException
+				 format: @"reallocation failed in %s",
+				 __PRETTY_FUNCTION__];
+		  destChar = newString + length;
+		}
 	      strcpy (destChar, "<br />");
 	      destChar += 6;
-	      delta = (destChar - newString);
-	      if (delta > length)
-		{
-		  length += 500;
-		  newString = realloc (newString, length + 500);
-		  destChar = newString + delta;
-		}
+	      iteration++;
 	    }
 	  else
 	    {
@@ -81,9 +93,23 @@
       currentChar++;
     }
   *destChar = 0;
+  *newLength = (unsigned int) destChar - (unsigned int) newString;
 
+  return newString;
+}
+
+- (NSString *) stringByConvertingCRLNToHTML
+{
+  NSString *convertedString;
+  char *newString;
+  unsigned int newLength;
+
+  newString
+    = convertChars ([self cStringUsingEncoding: NSUTF8StringEncoding],
+		    [self lengthOfBytesUsingEncoding: NSUTF8StringEncoding],
+		    &newLength);
   convertedString = [[NSString alloc] initWithBytes: newString
-				      length: (destChar - newString)
+				      length: newLength
 				      encoding: NSUTF8StringEncoding];
   [convertedString autorelease];
   free (newString);