Re: [PATCH] Fix imap_auth_gss() security level size check and buf_size type.
"Kevin J. McCarthy" <[email protected]>
| Newsgroups | gmane.mail.mutt.devel |
|---|---|
| Message-ID | <aeWd1yqEwEn7_kF8@qinghai> |
On Sun, Apr 19, 2026 at 08:46:49AM +0200, Alejandro Colomar via Mutt-dev wrote: >On 2026-04-19T13:51:31+0800, Kevin J. McCarthy wrote: >> Make sure send_token.length is 4 bytes before reading the data. >> >> Fix the buf_size type to be uint32_t instead of long. ntohl() >> operates on, and returns, a 32 bit unsigned integer. Most >> architectures now use a 64-bit long. >> >> I believe this only worked because in Little-Endian, the >> least-significant bits come first, so even though we were using 8 >> bytes of send_token.value (4 of which were out of bounds) for the cast >> to long, only the first 4 bytes were used to truncate to the uint32_t >> that ntohl() used. Likewise when we converted htonl() further down. >> >> Additionally, the comments indicate that mutt wasn't using buf_size in >> any case, so perhaps that also explains the lack of bug reports. >> >> Thanks to [email protected] for the security report. > >Reviewed-by: Alejandro Colomar <[email protected]> Pushed to stable. Merged into master with the dprint translated to muttdbg. -- Kevin J. McCarthy GPG Fingerprint: 8975 A9B3 3AA3 7910 385C 5308 ADEF 7684 8031 6BDA
signature.asc
(application/pgp-signature, 833 B)
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEiXWpszqjeRA4XFMIre92hIAxa9oFAmnlndcACgkQre92hIAx a9qF8BAA2culET+W2wap8wOmEqBe7jXrGmUEKUggs/BCCGi5aK4kYyy7gmUMLk3B 6mOw613MLSg3SPVSETVAl4Pj5/4CrDV2Xc7Q5fk2Ee+jgFtahhL+hd2+5aDiCXd2 J1ybNISLvg0qKouzl13xqaCRYabBYkXfUNc7C/u9W/G+6a9yJ4+4ARZTTaxljTY+ Bs+ey5fBZaG+mqv2fQ78vK5fhfosRKE1Wns8AhaOIQ3/NF03ewG+FxGV3wsLwOOY 1Q6OZn5iEJ9Jujix+HPcpCZhIud+V0sCnxLsS8Pxxhq4WY+ojd/OyvEHhZIMZhAy 9nsf0Bzo0SwhGxEpfJMv23Au9by80szr/oDp9YJS9NOk3yTHnWiDNRlyntMSeUS7 yVFZg021J1KcPU8zEhRuTEdGl8mqd1i/Z8sW4aLP1LgtdC2TE/67DRfMYZ8+ijQV M+d9qWdeCl5bvr/f8zgsSuRe1KvK+hGlpTeyzU6u+yOjBjeoXaOPclnnxEn1b7ts RyJjc727xvBcfmiF5MT2/Icmx31nAPtmZkBpubIzfUQSeiMJlUTlkKw9+aNYEK1C JYu8U1HQjMYSQOFe3dbs8I5a03t1rokwE7UXh/Pdxj0oSIQTKhcDyxTEhVi7yMVL r1MB2W/b/j3DVK0wgMR5e+TWMxHc3y6T3I5Tn4mqZhsRAKcEAnQ= =HIxJ -----END PGP SIGNATURE-----