From 2e18fee324694ebed9743ff1d5f5096af5edc937 Mon Sep 17 00:00:00 2001 From: Stephan Bosch Date: Fri, 10 Apr 2026 02:27:17 +0200 Subject: [PATCH] [PATCH] lib-sieve: sieve-binary-code - Fix single byte oob stack buffer write in sieve_binary_emit_integer() Gbp-Pq: Name 0001-lib-sieve-sieve-binary-code-Fix-single-byte-oob-stac.patch --- pigeonhole/src/lib-sieve/sieve-binary-code.c | 2 +- pigeonhole/tests/test-size.svtest | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/pigeonhole/src/lib-sieve/sieve-binary-code.c b/pigeonhole/src/lib-sieve/sieve-binary-code.c index 60bcfa1..c1f4444 100644 --- a/pigeonhole/src/lib-sieve/sieve-binary-code.c +++ b/pigeonhole/src/lib-sieve/sieve-binary-code.c @@ -124,7 +124,7 @@ sieve_size_t sieve_binary_emit_integer(struct sieve_binary_block *sblock, sieve_number_t integer) { sieve_size_t address = _sieve_binary_block_get_size(sblock); - uint8_t buffer[sizeof(sieve_number_t) + 1]; + uint8_t buffer[sizeof(sieve_number_t) * 8 / 7 + 1]; int bufpos = sizeof(buffer) - 1; /* Encode last byte [0xxxxxxx]; msb == 0 marks the last byte */ diff --git a/pigeonhole/tests/test-size.svtest b/pigeonhole/tests/test-size.svtest index dd5cdc4..95517d1 100644 --- a/pigeonhole/tests/test-size.svtest +++ b/pigeonhole/tests/test-size.svtest @@ -72,3 +72,12 @@ test "Exact size" { } } +/* + * TEST: Extreme size + */ + +test "Extreme size" { + if size :over 18446744073709551615 { + test_fail "size :over matched extreme size"; + } +} -- 2.39.5