Repository navigation
mailinfo: preserve embedded NUL in parse_header and fix memory leaks - #2474
inanna-malick wants to merge 1 commit into
Conversation
When handle_body() decodes Base64 or quoted-printable body lines, embedded NUL bytes remain in the decoded line strbuf. However, when an in-body header is parsed via check_header() -> parse_header(), parse_header() and decode_header() copy the header value with strbuf_addstr(), which truncates at the first NUL byte before handle_info() can reject the header with its `memchr(hdr->buf, '\0', hdr->len)` check. Use `strbuf_add()` with the remaining strbuf length in `parse_header()` and `decode_header()` so embedded NUL bytes in in-body headers are preserved and rejected by `handle_info()`. Also fix two small memory leaks in mailinfo: - In check_header(), free any previous `mi->message_id` before overwriting it when multiple Message-ID headers are present. - In clear_mailinfo(), call `strbuf_release(*(mi->content_top))` before freeing `*(mi->content_top)` when cleaning up unclosed multipart boundaries. Found via agent swarm driven property tests using https://recursion.wtf/posts/agents-and-property-tests/ Signed-off-by: Inanna Malick <inanna@recursion.wtf>
github-project-automation
Bot
moved this to Todo
in Op-Amp Frequency Response and Applications Suite
Welcome to GitGitGadgetHi @inanna-malick, and welcome to GitGitGadget, the GitHub App to send patch series to the Git mailing list from GitHub Pull Requests. Please make sure that either:
You can CC potential reviewers by adding a footer to the PR description with the following syntax: NOTE: DO NOT copy/paste your CC list from a previous GGG PR's description, Also, it is a good idea to review the commit messages one last time, as the Git project expects them in a quite specific form:
It is in general a good idea to await the automated test ("Checks") in this Pull Request before contributing the patches, e.g. to avoid trivial issues such as unportable code. Contributing the patchesBefore you can contribute the patches, your GitHub username needs to be added to the list of permitted users. Any already-permitted user can do that, by adding a comment to your PR of the form Both the person who commented An alternative is the channel Once on the list of permitted usernames, you can contribute the patches to the Git mailing list by adding a PR comment If you want to see what email(s) would be sent for a After you submit, GitGitGadget will respond with another comment that contains the link to the cover letter mail in the Git mailing list archive. Please make sure to monitor the discussion in that thread and to address comments and suggestions (while the comments and suggestions will be mirrored into the PR by GitGitGadget, you will still want to reply via mail). If you do not want to subscribe to the Git mailing list just to be able to respond to a mail, you can download the mbox from the Git mailing list archive (click the curl -g --user "<EMailAddress>:<Password>" \
--url "imaps://imap.gmail.com/INBOX" -T /path/to/raw.txtTo iterate on your change, i.e. send a revised patch or patch series, you will first want to (force-)push to the same branch. You probably also want to modify your Pull Request description (or title). It is a good idea to summarize the revision by adding something like this to the cover letter (read: by editing the first comment on the PR, i.e. the PR description): To send a new iteration, just add another PR comment with the contents: Need help?New contributors who want advice are encouraged to join git-mentoring@googlegroups.com, where volunteers who regularly contribute to Git are willing to answer newbie questions, give advice, or otherwise provide mentoring to interested contributors. You must join in order to post or view messages, but anyone can join. You may also be able to find help in real time in the developer IRC channel, |
There was a problem hiding this comment.
🟡 Changes recommended
Missing regression tests for Base64 and quoted-printable bodies with embedded NULs in in-body Subject headers leave the truncation bug vulnerable to silent reintroduction.
1 open issue
What changed in this PR
This PR fixes mailinfo header handling so embedded NUL bytes survive parsing and reach the existing rejection check. It also addresses two memory leaks.
Changes:
- Use length-aware copies in
parse_header()anddecode_header(). - Free the previous message ID before replacing it.
- Release boundary buffers when cleaning up unclosed multipart messages.
| File | Description |
|---|---|
mailinfo.c |
Preserves embedded NUL bytes in headers and fixes message-ID and multipart-boundary cleanup. |
Review effort: Balanced
| if (!skip_header(line, hdr, &val_str)) | ||
| return 0; | ||
| strbuf_addstr(val, val_str); | ||
| strbuf_add(val, val_str, line->len - (val_str - line->buf)); |
When
handle_body()decodes Base64 or quoted-printable body lines, embedded NUL bytes remain in the decodedlinestrbuf. However, when an in-body header is parsed viacheck_header()->parse_header(),parse_header()anddecode_header()copy the header value withstrbuf_addstr(), which truncates at the first NUL byte beforehandle_info()can reject the header with itsmemchr(hdr->buf, '\0', hdr->len)check. Usestrbuf_add()with the remainingstrbuflength inparse_header()anddecode_header()so embedded NUL bytes in in-body headers are preserved and rejected byhandle_info().Also fix two memory leaks in
mailinfo.c:check_header(),free(mi->message_id)before overwriting it when multipleMessage-IDheaders are present.clear_mailinfo(), callstrbuf_release(*(mi->content_top))before freeing*(mi->content_top)when cleaning up unclosed multipart boundaries.Found via agent swarm driven property tests using https://recursion.wtf/posts/agents-and-property-tests/