CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
authorHeiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Mon, 29 Mar 2021 20:44:47 +0000 (22:44 +0200)
committerHeiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Thu, 27 May 2021 19:30:47 +0000 (21:30 +0200)
Based on Phil Pennock's 8a50c88a, done by Qualys

(cherry picked from commit 8161c16ec7320ac6164954bade23179a0ed095eb)
(cherry picked from commit 71585e8fcb8704a9f431f5a8d019280cccaad069)

src/src/parse.c

index cfc1f996f8bc9cefacd07d5a4f172fdc3d2fbac5..e0470c86f51236265d9ba67b671e420c34b77112 100644 (file)
@@ -1134,12 +1134,7 @@ while (s < end)
             {
             if (ss >= end) ss--;
             *t++ = '(';
             {
             if (ss >= end) ss--;
             *t++ = '(';
-            if (ss < s)
-              {
-              /* Someone has ended the string with "<punct>(". */
-              ss = s;
-              }
-            else
+            if (ss > s)
               {
               Ustrncpy(t, s, ss-s);
               t += ss-s;
               {
               Ustrncpy(t, s, ss-s);
               t += ss-s;