Add some more sanity checks about content-length.

diff --git a/mbox.c b/mbox.c
index a715c191cb47c0328dc476e5bc6bb8dd48e4ed8c..07dc7e6ab3cb1129d7c952114187e797a4a4a58a 100644 (file)
--- a/mbox.c
+++ b/mbox.c
@@ -155,7 +155,7 @@ int mmdf_parse_mailbox (CONTEXT *ctx)
       {
        tmploc = loc + hdr->content->length;
 
-       if (tmploc < ctx->size)
+       if (0 < tmploc && tmploc < ctx->size)
        {
          if (fseek (ctx->fp, tmploc, SEEK_SET) != 0 ||
              fgets (buf, sizeof (buf) - 1, ctx->fp) == NULL ||
@@ -298,7 +298,7 @@ int mbox_parse_mailbox (CONTEXT *ctx)
        loc = ftell (ctx->fp);
        tmploc = loc + curhdr->content->length + 1;
 
-       if (tmploc < ctx->size)
+       if (0 < tmploc && tmploc < ctx->size)
        {
          /*
           * check to see if the content-length looks valid.  we expect to

diff --git a/parse.c b/parse.c
index e3edc4d7533b1745f15701649dd9f82f29a05f95..fed50e30ae7828b723873079aa5925049777870e 100644 (file)
--- a/parse.c
+++ b/parse.c
@@ -975,7 +975,10 @@ ENVELOPE *mutt_read_rfc822_header (FILE *f, HEADER *hdr, short user_hdrs,
          else if (mutt_strcasecmp (line+8, "length") == 0)
          {
            if (hdr)
-             hdr->content->length = atoi (p);
+           {
+             if ((hdr->content->length = atoi (p)) < 0)
+               hdr->content->length = -1;
+           }
            matched = 1;
          }
          else if (mutt_strcasecmp (line+8, "description") == 0)