diff options
| author | Eduardo Chappa <chappa@washington.edu> | 2018-01-27 14:54:46 -0700 |
|---|---|---|
| committer | Eduardo Chappa <chappa@washington.edu> | 2018-01-27 14:54:46 -0700 |
| commit | e90f28bcc9d6e77d567bef2671c870bcd1c78719 (patch) | |
| tree | 4122cc51bb9183a53efa1b156935650b2e87d6c0 | |
| parent | fc082d271bd30310ce6928ed4341e11c36ba8ddb (diff) | |
| download | alpine-e90f28bcc9d6e77d567bef2671c870bcd1c78719.tar.xz | |
* Crash in forward_subject function, in the memmove function, which
was moving memory from allocated areas. Reported by Hisashi T Fujinaka
and Ferdinand Goldmann.
| -rw-r--r-- | pith/reply.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/pith/reply.c b/pith/reply.c index 383294ec..c7a481f4 100644 --- a/pith/reply.c +++ b/pith/reply.c @@ -2236,7 +2236,7 @@ forward_subject(ENVELOPE *env, int flags) (l < 5 || strcmp(tmp_20k_buf+l-5,"(fwd)"))){ snprintf(tmp_20k_buf+2000, SIZEOF_20KBUF-2000, "%s (fwd)", tmp_20k_buf); tmp_20k_buf[SIZEOF_20KBUF-2000-1] = '\0'; - memmove(tmp_20k_buf, tmp_20k_buf+2000, SIZEOF_20KBUF); + memmove(tmp_20k_buf, tmp_20k_buf+2000, strlen(tmp_20k_buf+2000)); tmp_20k_buf[SIZEOF_20KBUF-1] = '\0'; } |