mirror of
https://github.com/inverse-inc/sogo.git
synced 2026-11-08 02:07:09 +00:00
Alex J
ee02866730
Several places in the TNEF attachment decoder read a fixed number of bytes, or index at a fixed offset, out of a MAPI property's data buffer without checking the buffer is actually that large: - the possibly-embedded-TNEF signature, read at offset 16 for an object property and at offset 0 for plain file data - the same object-attachment data, when building the actual attachment content a few lines later: the length used there is derived from the same unchecked offset and underflows to a huge value for a short buffer - the classification flag, read as an 8-byte value - the recurrence pattern, indexed up to offset 0x23 but only checked for 0x1F bytes A short enough attachment property made these read, or in the attachment case allocate, past the end of the buffer. Add the missing length checks; where no further data is left to build from, skip that part of the output instead.