Re: Fwd: report 1/3: buffer under-read in rfc2047.c lwslen()

Alejandro Colomar via Mutt-dev <[email protected]> Sun, 21 Jun 2026 18:02:06 +0200

Newsgroups	gmane.mail.mutt.devel
Message-ID	<ajgKhraH1_niGEkY@devuan>

Hi Vincent,

On 2026-06-21T17:31:38+0200, Vincent Lefevre wrote:
> On 2026-06-20 22:48:38 +0200, Alejandro Colomar via Mutt-dev wrote:
> > Hi Vincent,
> > 
> > On 2026-06-20T19:39:29+0200, Vincent Lefevre wrote:
> > > On 2026-06-18 11:28:00 +0800, Kevin J. McCarthy wrote:
> > > > In this case, I think the proposed patch is the best solution:
> > > > 
> > > > diff --git a/rfc2047.c b/rfc2047.c
> > > > index d72ae997..2bdd8553 100644
> > > > --- a/rfc2047.c
> > > > +++ b/rfc2047.c
> > > > @@ -815,7 +815,7 @@ static size_t lwslen(const char *s, size_t n)
> > > >        len = (size_t)(p - s);
> > > >        break;
> > > >      }
> > > > -  if (strchr("\r\n", *(p-1))) /* LWS doesn't end with CRLF */
> > > > +  if (len > 0 && strchr("\r\n", *(p-1))) /* LWS doesn't end with CRLF */
> > > >      len = (size_t)0;
> > > >    return len;
> > > >  }
> > > 
> > > "len = (size_t)0;" has a cast, but "len > 0" doesn't.
> > > This doesn't matter much, but this is not consistent.
> > 
> > Comparison with a literal should not use casts.
> 
> OK here, but why is there a cast for the assignment, then?
> 
> If the cast is useless for the comparison, then it should also
> be useless for the assignment.

Agree.  I'd remove it.  I'd remove most casts in any program, FWIW, and
wrap all the few remaining necessary ones in macros that make them easy
to grep and verify.

In this case, I'd remove the cast in the assignment.


Have a lovely day!
Alex

-- 
<https://www.alejandro-colomar.es>

signature.asc (application/pgp-signature, 833 B)