Skip to content
  • Kevin J. McCarthy's avatar
    Fix write_one_header() illegal header check. · a4752eb0
    Kevin J. McCarthy authored
    This is another crash caused by the rfc2047 decoding bug fixed in the
    second prior commit.
    
    In this case, an empty header line followed by a header line starting
    with ":", would result in t==end.
    
    The mutt_substrdup() further below would go very badly at that point,
    with t >= end+1.  This could result in either a memcpy onto NULL or a
    huge malloc call.
    
    Thanks to Chenyuan Mi (@morningbread) for giving a working example
    draft message of the rfc2047 decoding flaw.  This allowed me, with
    further testing, to discover this additional crash bug.
    a4752eb0