Re: [Mutt] #2885: Buffer overflows in mutt_gecos_name

[Mutt <fleas@xxxxxxxx>]

#2885: Buffer overflows in mutt_gecos_name

Comment (by raylai):

 Actually this is all that is necessary:
 {{{
 --- muttlib.c.orig      Thu May  3 09:41:31 2007
 +++ muttlib.c   Thu May  3 13:54:16 2007
 @@ -536,7 +536,9 @@ char *mutt_gecos_name (char *dest, size_t destlen, str
    {
      if (dest[idx] == '&')
      {
 -      memmove (&dest[idx + pwnl], &dest[idx + 1],
 +      /* Don't move if destination is outside buffer. */
 +      if (idx + pwnl < destlen)
 +        memmove (&dest[idx + pwnl], &dest[idx + 1],
                MAX(destlen - idx - pwnl - 1, 0));
        memcpy (&dest[idx], pw->pw_name, MIN(destlen - idx - 1, pwnl));
        dest[idx] = toupper ((unsigned char) dest[idx]);
 |||

-- 
Ticket URL: <http://dev.mutt.org/trac/ticket/2885#comment:1>