fetchmail-friends
[Top] [All Lists]

[fetchmail] about that fetchmail imap message count vulnerability and alloca()

2002-07-03 10:29:23
I tried several small programs experiencing with alloca and it just
NEVER returned NULL, even when asked to allocate 1Gb of memory. It
just returned a pointer which was, of course, unusable on my system
at least (128Mb ram + 128Mb swap).

fetchmail's driver.c(1338):
                    if (count > INT_MAX/sizeof(int))
                    {
                        report(stderr, GT_("bogus message count!"));
                        return(PS_PROTOCOL);
                    }

                    /* OK, we're going to gather size info next */
                    xalloca(msgsizes, int *, sizeof(int) * count);
                    xalloca(msgcodes, int *, sizeof(int) * count);
                    for (i = 0; i < count; i++)
                        msgcodes[i] = MSGLEN_UNKNOWN;

xalloca is:
#define xalloca(ptr, t, n)      if (!(ptr = (t) alloca(n)))\
       {report(stderr, GT_("alloca failed")); exit(PS_UNDEFINED);}

That patch seems to only take care of count's wraparound, where less
memory would be allocated but later written to. Or?

So, at least with linux's glibc and gcc, alloca never fails. Never.