From: Stephan Bosch <stephan.bosch@open-xchange.com>
Date: Fri, 10 Apr 2026 00:27:17 +0000 (+0200)
Subject: [PATCH] lib-sieve: sieve-binary-code - Fix single byte oob stack buffer write in... 
X-Git-Tag: archive/raspbian/1%2.4.1+dfsg1-6+rpi1+deb13u7^2~46
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=2e18fee324694ebed9743ff1d5f5096af5edc937;p=dovecot.git

[PATCH] lib-sieve: sieve-binary-code - Fix single byte oob stack buffer write in sieve_binary_emit_integer()


Gbp-Pq: Name 0001-lib-sieve-sieve-binary-code-Fix-single-byte-oob-stac.patch
---

diff --git a/pigeonhole/src/lib-sieve/sieve-binary-code.c b/pigeonhole/src/lib-sieve/sieve-binary-code.c
index 60bcfa1..c1f4444 100644
--- a/pigeonhole/src/lib-sieve/sieve-binary-code.c
+++ b/pigeonhole/src/lib-sieve/sieve-binary-code.c
@@ -124,7 +124,7 @@ sieve_size_t sieve_binary_emit_integer(struct sieve_binary_block *sblock,
 				       sieve_number_t integer)
 {
 	sieve_size_t address = _sieve_binary_block_get_size(sblock);
-	uint8_t buffer[sizeof(sieve_number_t) + 1];
+	uint8_t buffer[sizeof(sieve_number_t) * 8 / 7 + 1];
 	int bufpos = sizeof(buffer) - 1;
 
 	/* Encode last byte [0xxxxxxx]; msb == 0 marks the last byte */
diff --git a/pigeonhole/tests/test-size.svtest b/pigeonhole/tests/test-size.svtest
index dd5cdc4..95517d1 100644
--- a/pigeonhole/tests/test-size.svtest
+++ b/pigeonhole/tests/test-size.svtest
@@ -72,3 +72,12 @@ test "Exact size" {
 	}
 }
 
+/*
+ * TEST: Extreme size
+ */
+
+test "Extreme size" {
+	if size :over 18446744073709551615 {
+		test_fail "size :over matched extreme size";
+	}
+}