search

cyrusimap / cyrus-sasl

Other
134 stars 151 forks source link

Fix heap corruption #819

Closed GuidoKiener closed 4 months ago

GuidoKiener commented 11 months ago

Calculation of resultlen is wrong. E.g. if server allows only one mechanism SCRAM-SHA-256, the expected string for the mechlist_buf is "SCRAM-SHA-256-PLUS SCRAM-SHA-256" with a required size of 33 bytes and not 32 bytes. Note that (strlen(mysep) (s_conn->mech_length - 1) 2) = 0 when s_conn->mech_length = 1.

Neustradamus commented 11 months ago

@GuidoKiener: Good!

cc: @aamelnikov.