git://git.exim.org
/
exim.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Buffer overrun fix. fixes: bug #787
[exim.git]
/
src
/
src
/
string.c
diff --git
a/src/src/string.c
b/src/src/string.c
index 20bd1d1f30199660eff520951116de5386ca219c..83455294dc824b5ce5e4734725c513110ce66174 100644
(file)
--- a/
src/src/string.c
+++ b/
src/src/string.c
@@
-1,4
+1,4
@@
-/* $Cambridge: exim/src/src/string.c,v 1.1
3 2007/02/26 14:07:04 ph10
Exp $ */
+/* $Cambridge: exim/src/src/string.c,v 1.1
4 2008/12/12 14:36:37 nm4
Exp $ */
/*************************************************
* Exim - an Internet mail transport agent *
/*************************************************
* Exim - an Internet mail transport agent *
@@
-1267,10
+1267,17
@@
while (*fp != 0)
not OK, add part of the string (debugging uses this to show as
much as possible). */
not OK, add part of the string (debugging uses this to show as
much as possible). */
+ if (p == last)
+ {
+ yield = FALSE;
+ goto END_FORMAT;
+ }
if (p >= last - width)
{
yield = FALSE;
width = precision = last - p - 1;
if (p >= last - width)
{
yield = FALSE;
width = precision = last - p - 1;
+ if (width < 0) width = 0;
+ if (precision < 0) precision = 0;
}
sprintf(CS p, "%*.*s", width, precision, s);
if (fp[-1] == 'S')
}
sprintf(CS p, "%*.*s", width, precision, s);
if (fp[-1] == 'S')