aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--NEWS3
-rw-r--r--sink.c2
-rw-r--r--transact.c8
3 files changed, 8 insertions, 5 deletions
diff --git a/NEWS b/NEWS
index 3b4c5564..a0103ce2 100644
--- a/NEWS
+++ b/NEWS
@@ -80,6 +80,9 @@ fetchmail 6.3.0 (not yet released officially):
sizeof(int) != sizeof(size_t). (Matthias Andree)
* Nalin Dahyabhai's fix for driver.c to not call the private Kerberos
krb5_init_ets() function. Sent by Miloslav Trmac. (Matthias Andree)
+* Nalin Dahyabhai's fix for sink.c/transact.c to reserve sufficient
+ space for \r\n trailers in snprintf calls. Sent by Miloslav Trmac,
+ possibly fixing Red Hat bug #114470. (Matthias Andree).
fetchmail-6.2.5 (Wed Oct 15 18:39:22 EDT 2003), 23079 lines:
diff --git a/sink.c b/sink.c
index 68a1739b..59c4fab7 100644
--- a/sink.c
+++ b/sink.c
@@ -1540,7 +1540,7 @@ va_dcl
#else
va_start(ap);
#endif
- vsnprintf(buf, sizeof(buf), fmt, ap);
+ vsnprintf(buf, sizeof(buf) - 2, fmt, ap);
va_end(ap);
snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "\r\n");
diff --git a/transact.c b/transact.c
index f9328df2..85cf0f38 100644
--- a/transact.c
+++ b/transact.c
@@ -1413,7 +1413,7 @@ va_dcl
va_list ap;
if (protocol->tagged && !suppress_tags)
- (void) sprintf(buf, "%s ", GENSYM);
+ snprintf(buf, sizeof(buf) - 2, "%s ", GENSYM);
else
buf[0] = '\0';
@@ -1422,7 +1422,7 @@ va_dcl
#else
va_start(ap);
#endif
- vsnprintf(buf + strlen(buf), sizeof(buf)-strlen(buf), fmt, ap);
+ vsnprintf(buf + strlen(buf), sizeof(buf)-2-strlen(buf), fmt, ap);
va_end(ap);
snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "\r\n");
@@ -1490,7 +1490,7 @@ va_dcl
phase = SERVER_WAIT;
if (protocol->tagged && !suppress_tags)
- (void) sprintf(buf, "%s ", GENSYM);
+ snprintf(buf, sizeof(buf) - 2, "%s ", GENSYM);
else
buf[0] = '\0';
@@ -1499,7 +1499,7 @@ va_dcl
#else
va_start(ap);
#endif
- vsnprintf(buf + strlen(buf), sizeof(buf)-strlen(buf), fmt, ap);
+ vsnprintf(buf + strlen(buf), sizeof(buf)-2-strlen(buf), fmt, ap);
va_end(ap);
snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "\r\n");