Re: Fwd: report 1/3: buffer under-read in rfc2047.c lwslen()

"Kevin J. McCarthy" <[email protected]> Thu, 18 Jun 2026 08:13:35 +0800

Newsgroups	gmane.mail.mutt.devel
Message-ID	<[email protected]>

On Thu, Jun 18, 2026 at 08:09:01AM +0800, Kevin J. McCarthy wrote:
>From: Acts1631 <[email protected]>
>The lwslen() helper calculates the length of linear whitespace at the beginning of a string. It scans until the first non-whitespace character, then evaluates *(p - 1):
>
>  for (; p < s + n; p++)
>    if (!strchr(" \t\r\n", *p))
>    {
>      len = (size_t)(p - s);
>      break;
>    }
>  if (strchr("\r\n", *(p-1)))
>    len = (size_t)0;

This relies on 1) a invalid rfc2047 encodeed word (because the spec says 
there must be LWN) and 2) an obscure option being set, which defaults 
off.

However, the bug report is valid.  Mutt will under-read the buffer.

-- 
Kevin J. McCarthy
GPG Fingerprint: 8975 A9B3 3AA3 7910 385C  5308 ADEF 7684 8031 6BDA

signature.asc (application/pgp-signature, 833 B)