Re: Fwd: report 3/3: latent unterminated buffer in imap_wordcasecmp()

"Kevin J. McCarthy" <[email protected]> Thu, 18 Jun 2026 08:19:49 +0800

Newsgroups	gmane.mail.mutt.devel
Message-ID	<[email protected]>

On Thu, Jun 18, 2026 at 08:09:17AM +0800, Kevin J. McCarthy wrote:
>----- Forwarded message from Acts1631 <[email protected]> -----
>From: Acts1631 <[email protected]>

>Since Capabilities[x] elements are short fixed strings (e.g., 
>"IMAP4rev1", "CONDSTORE"), ascii_strcasecmp() will return before 
>reading the uninitialized tmp[126] byte. However, the helper is buggy 
>in isolation.

This basically sums it up.  The comparison function is buggy, but since 
mutt controls the list of compared strings we won't hit the bug.

I don't want to accept an AI rewrite just before 2.4.0, so I'll try to 
look for alternative fixes.  Or if any of you want to take a look and 
propose a minimal fix for before I get to it, that would be great too.

Thanks.

-- 
Kevin J. McCarthy
GPG Fingerprint: 8975 A9B3 3AA3 7910 385C  5308 ADEF 7684 8031 6BDA

signature.asc (application/pgp-signature, 833 B)