Prevent potential buffer overrun by one byte.

2006-11-02  Hans Petter Jansson  <hpj@novell.com>

	* camel-mime-filter-tohtml.c (writeln): Prevent potential buffer
	overrun by one byte.

	* camel-gpg-context.c (gpg_ctx_op_step): Clear the poll structures'
	events fields, so we don't pass uninitialized values to poll().

diff --git a/camel/ChangeLog b/camel/ChangeLog
index fa0311a..d2e0cef 100644 (file)
--- a/camel/ChangeLog
+++ b/camel/ChangeLog
@@ -1,3 +1,11 @@
+2006-11-02  Hans Petter Jansson  <hpj@novell.com>
+
+       * camel-mime-filter-tohtml.c (writeln): Prevent potential buffer
+       overrun by one byte.
+
+       * camel-gpg-context.c (gpg_ctx_op_step): Clear the poll structures'
+       events fields, so we don't pass uninitialized values to poll().
+
 2006-11-02  Harish Krishnaswamy  <kharish@novell.com>
 
        * camel-mime-filter-crlf.c (filter): Fixes buffer overrun. 

diff --git a/camel/camel-gpg-context.c b/camel/camel-gpg-context.c
index 5bd7a3a..f50bed2 100644 (file)
--- a/camel/camel-gpg-context.c
+++ b/camel/camel-gpg-context.c
@@ -1016,8 +1016,10 @@ gpg_ctx_op_step (struct _GpgCtx *gpg, CamelException *ex)
        struct pollfd polls[6];
        int status, i, cancel_fd;
 
-       for (i=0;i<6;i++)
+       for (i=0;i<6;i++) {
                polls[i].fd = -1;
+               polls[i].events = 0;
+       }
 
        if (!gpg->seen_eof1) {
                polls[0].fd = gpg->stdout_fd;

diff --git a/camel/camel-mime-filter-tohtml.c b/camel/camel-mime-filter-tohtml.c
index dab3ac3..cda7441 100644 (file)
--- a/camel/camel-mime-filter-tohtml.c
+++ b/camel/camel-mime-filter-tohtml.c
@@ -204,7 +204,7 @@ writeln (CamelMimeFilter *filter, const char *in, const char *inend, char *outpt
                        /* otherwise, FALL THROUGH */
                case ' ':
                        if (html->flags & CAMEL_MIME_FILTER_TOHTML_CONVERT_SPACES
-                           && ((inptr == (in + 1) || *inptr == ' ' || *inptr == '\t'))) {
+                           && ((inptr == (in + 1) || (inptr < inend && (*inptr == ' ' || *inptr == '\t'))))) {
                                outptr = g_stpcpy (outptr, "&nbsp;");
                                html->column++;
                                break;