mirror of
https://github.com/inverse-inc/sogo.git
synced 2026-11-08 02:07:09 +00:00
Alex J
ee02866730
Several places in the TNEF attachment decoder read a fixed number of bytes, or index at a fixed offset, out of a MAPI property's data buffer without checking the buffer is actually that large: - the possibly-embedded-TNEF signature, read at offset 16 for an object property and at offset 0 for plain file data - the same object-attachment data, when building the actual attachment content a few lines later: the length used there is derived from the same unchecked offset and underflows to a huge value for a short buffer - the classification flag, read as an 8-byte value - the recurrence pattern, indexed up to offset 0x23 but only checked for 0x1F bytes A short enough attachment property made these read, or in the attachment case allocate, past the end of the buffer. Add the missing length checks; where no further data is left to build from, skip that part of the output instead.
Contribute
SOGo is a collaborative effort in order to create the best Free and Open Source groupware solution.
There are multiple ways you can contribute to the project
- Documentation reviews, enhancements and translations
- Feature requests or by sharing your ideas (see the roadmap)
- Participate in the discussion on mailing lists
- Patches for bugs or enhancements
- Provide new translations
Source Code
You can browse the lastest version of the source code online from Alinto's github repository:
To compile SOGo, you first need to obtain the source code of both SOGo and SOPE. The source code of SOPE and SOGo can be obtained from Alinto's github repositories:
The source code of the SOGo Connector extension for Thunderbird 78+ can be obtained from Alinto's github repository:
Please refer to the FAQ for compilation instructions.
Dev Container
A dev container is available to use, read more there read more there
Translations
SOGo and its associated components are available in various languages. The following list describes the official translations alongside their maintainers:
- [en] English - Alinto
- [ar] Arabic - Anass Ahmed
- [eu] Basque - Gorka Gonzalez
- [bs_BA] Bosnian - Refik Bećirović
- [pr_BR] Brazilian Portuguese - Alexandre Marcilio
- [bg] Bulgarian - Todor Todorov
- [ca] Catalan - Hector M. Rulot Segovia
- [zh_CN] Chinese (China) - Thomas Kuiper
- [zh_TW] Chinese (Taiwan)
- [hr_HR] Croatian - Jens Riecken
- [cs] Czech - Šimon Halamásek
- [da_DK] Danish (Denmark) - Altibox
- [nl] Dutch - Roel van Os
- [fi] Finnish - Kari Salmu
- [fr] French - Alinto
- [gl] Galician - Simon Lang
- [de] German - Alexander Greiner-Baer
- [he] Hebrew - Raz Aidlitz
- [hu] Hungarian - Sándor Kuti
- [id] Indonesian - Woka
- [is] Icelandic - Anna Jonna Armannsdottir
- [it] Italian - Alessio Fattorini
- [jp] Japanese - Ryo Yamamoto
- [kk] Kazakh - Nazym Idrissova
- [lv] Latvian - Juris Balandis
- [lt] Lithuanian - Mantas Liobė
- [mk_MK] Macedonian - Miroslav Jovanovic
- [sr_ME] Montenegrin - Ivan Pleskonjić
- [nb_NO] Norwegian (Bokmål) - Jan Ivar Karlsen / Altibox
- [nn_NO] Norwegian (Nynorsk) - Altibox
- [pl] Polish - Paweł Bogusławski
- [pt] Portuguese - Eduardo Crispim
- [ro_RO] Romanian - Vasile Razvan Luca
- [ru] Russian - Alex Kabakaev
- [sr] Serbian - Bogdanović Bojan
- [sr@latin)] Serbian (Latin) - Zlatko Štulić
- [sk] Slovak - Martin Pastor
- [sl_SI] Slovenian - Jens Riecken
- [es_AR] Spanish (Argentina) - Federico Alberto Sayd
- [es_ES] Spanish (Spain) - Dominique Couot
- [sv] Swedish - Peter Johansson
- [tr_TR] Turkish (Turkey) - Muhammed Yalçınkaya, Sinan Kurşunoğlu
- [uk] Ukrainian - Oleksa Stasevych
- [cy] Welsh - Iona Bailey
If you would like to translate the software in an other language, please consult the FAQ.