Bug#621690: Confirmed/solved

[Doug Torrance]

On 06/23/2017 05:04 AM, Demi wrote:
>> wmbiff change path of my mailboxes next nearest.
>>
>> For example wmbiff change 'gleb' to 'glil' for second and fourth mailboxes.
>> However the 1st, 3rd and 5th mailboxes have correct path.
> 
> Well, the indices don't really enter.  I'm actually surprised this
> isn't more trouble.
> 
> The underlying reason is that in wmbiff.c:parse_mbox_path, the
> program calls
> 
>    mboxCreate((&mbox[item]), mbox[item].path);
> 
> which for maildirs calls
> 
>    int maildirCreate(Pop3 pc, const char *str)
> 
> in maildirClient.c.  str in this way is an alias for pc->path.
> 
> In maildirCreate, after some char acrobatics, the program eventually
> does
> 
>    strncpy(pc->path, str + 8 + i, BUF_BIG - 1);
> 
> to cut off the leading stuff from the maildir.  The result of this
> operation is not defined, as pc->path and str point to the same
> memory and thus the arguments overlap, which strncpy outlaws.
> 
> A simple fix is to copy manually, like this:
> 
> 		DM(pc, DEBUG_ERROR, "maildir '%s' is too long.\n", str + 8 + i);
> 		memset(pc->path, 0, BUF_BIG);
> 	} else {
> +		const char *sp = str + 8 + i;
> +		char *dp = pc->path;
> +
> +		while (*sp && sp-str<BUF_BIG-1) {
> +			*dp++ = *sp++;
> +		}
> +		*dp = 0;
> -		strncpy(pc->path, , BUF_BIG - 1);	/* cut off ``maildir:'' */
> 	}
> 
> -- it's what I'm doing now.  But I give you that's a bit pedestrian.

Thanks for the fix!

I've released a new version of wmbiff with your patch and will upload it 
to Debian in the near future.