Several places in the TNEF attachment decoder read a fixed number of
bytes, or index at a fixed offset, out of a MAPI property's data buffer
without checking the buffer is actually that large:
- the possibly-embedded-TNEF signature, read at offset 16 for an object
property and at offset 0 for plain file data
- the same object-attachment data, when building the actual attachment
content a few lines later: the length used there is derived from the
same unchecked offset and underflows to a huge value for a short buffer
- the classification flag, read as an 8-byte value
- the recurrence pattern, indexed up to offset 0x23 but only checked for
0x1F bytes
A short enough attachment property made these read, or in the attachment
case allocate, past the end of the buffer.
Add the missing length checks; where no further data is left to build
from, skip that part of the output instead.
generateMessageID: appended the substring following the last '@'
without sanitizing it, so a sender value such as 'Doe, John <a@b>'
produced 'Message-Id: <uuid@b>>' with a duplicated closing bracket on
calendar invitations. A nil domain also left the message-id
unterminated.
The domain part is now cut at the first address delimiter or
whitespace - a domain is a single token, and anything else would
allow header injection through generated message-ids.
Fixes#6201
the trailing while loop reuses the regex variable, which by then points at the
angular brace pattern whenever stripAngular is YES. that pattern has two
capture groups while the loop substitutes $1@im****$3, so NSRegularExpression
raises NSInvalidArgumentException and the NS_HANDLER swallows it.
give the @import pattern its own variable and use it in both the replacement
and the loop. the replacement also used the template of the block above, which
dropped the whole style element instead of masking the @import in place, so
test_stringWithoutHTMLInjection failed. it passes again, and a case with
stripAngular YES covers the loop.
Improving the filtering of the calender objects, keeping a global static of the array of tags
that are allowed. And using removeChildren to prevent the need of a full copy while we iterate
over it.
fetching public ICS files without this patch result in continual opening
and closing of the "Localizable.strings" to create a NSDictionary,
looking up one key and closing it again. By caching it in a static
variable this greatly improves the performance.
Alex J
Hivert Quentin
Hadrien Blanc
smizrahi
Jan Kahmen
Emily Kooistra