Files
sogo/SoObjects/Mailer
Alex J ee02866730 fix(mail): check buffer length before reading TNEF properties
Several places in the TNEF attachment decoder read a fixed number of
bytes, or index at a fixed offset, out of a MAPI property's data buffer
without checking the buffer is actually that large:

- the possibly-embedded-TNEF signature, read at offset 16 for an object
  property and at offset 0 for plain file data
- the same object-attachment data, when building the actual attachment
  content a few lines later: the length used there is derived from the
  same unchecked offset and underflows to a huge value for a short buffer
- the classification flag, read as an 8-byte value
- the recurrence pattern, indexed up to offset 0x23 but only checked for
  0x1F bytes

A short enough attachment property made these read, or in the attachment
case allocate, past the end of the buffer.

Add the missing length checks; where no further data is left to build
from, skip that part of the output instead.
2026-11-06 16:21:03 +01:00
..
2019-07-19 12:50:18 -04:00
2019-07-19 12:50:18 -04:00
2026-03-02 15:01:52 +01:00
2019-07-19 12:50:18 -04:00
2019-07-19 12:50:18 -04:00
2019-07-19 12:50:18 -04:00
2019-10-23 12:54:32 -04:00
2019-07-19 12:50:18 -04:00
2025-07-03 16:59:56 +02:00
2017-12-23 05:15:39 -05:00
2022-01-21 16:24:13 -05:00
2017-12-23 04:49:57 -05:00
2017-12-23 04:49:25 -05:00
2017-12-23 04:51:06 -05:00
2015-11-04 07:24:02 +08:00
2018-01-04 10:44:15 -05:00
2018-01-04 10:44:15 -05:00