[PATCH] lib-sieve: sieve-binary-code - Fix single byte oob stack buffer write in...

Gbp-Pq: Name 0001-lib-sieve-sieve-binary-code-Fix-single-byte-oob-stac.patch

diff --git a/pigeonhole/src/lib-sieve/sieve-binary-code.c b/pigeonhole/src/lib-sieve/sieve-binary-code.c
index 60bcfa109008cb83a37bf28a2e233baadca6ffc0..c1f4444f2f1f4905354d2f41c009c758b87f0b9e 100644 (file)
--- a/pigeonhole/src/lib-sieve/sieve-binary-code.c
+++ b/pigeonhole/src/lib-sieve/sieve-binary-code.c
@@ -124,7 +124,7 @@ sieve_size_t sieve_binary_emit_integer(struct sieve_binary_block *sblock,
                                       sieve_number_t integer)
 {
        sieve_size_t address = _sieve_binary_block_get_size(sblock);
-       uint8_t buffer[sizeof(sieve_number_t) + 1];
+       uint8_t buffer[sizeof(sieve_number_t) * 8 / 7 + 1];
        int bufpos = sizeof(buffer) - 1;
 
        /* Encode last byte [0xxxxxxx]; msb == 0 marks the last byte */

diff --git a/pigeonhole/tests/test-size.svtest b/pigeonhole/tests/test-size.svtest
index dd5cdc4f42e55abd98b645e5166a487033a6ec99..95517d1e8f659996e3fb99200cd9ec082a6ed33b 100644 (file)
--- a/pigeonhole/tests/test-size.svtest
+++ b/pigeonhole/tests/test-size.svtest
@@ -72,3 +72,12 @@ test "Exact size" {
        }
 }
 
+/*
+ * TEST: Extreme size
+ */
+
+test "Extreme size" {
+       if size :over 18446744073709551615 {
+               test_fail "size :over matched extreme size";
+       }
+}