Actions
Bug #6904
closed
VJ
PA
mime: buffer overflow in GetFullValue() (util-decode-mime.c)
Bug #6904:
mime: buffer overflow in GetFullValue() (util-decode-mime.c)
Affected Versions:
Effort:
Difficulty:
Label:
Description
static uint8_t *GetFullValue(const DataValue *dv, uint32_t *olen)
{
uint32_t offset = 0;
uint8_t *val = NULL;
uint32_t len = 0;
*olen = 0;
/* First calculate total length */
for (const DataValue *curr = dv; curr != NULL; curr = curr->next) {
[1] len += curr->value_len;
}
/* Must have at least one character in the value */
if (len > 0) {
[2] val = SCCalloc(1, len);
if (unlikely(val == NULL)) {
return NULL;
}
for (const DataValue *curr = dv; curr != NULL; curr = curr->next) {
[3] memcpy(val + offset, curr->value, curr->value_len);
offset += curr->value_len;
}
}
*olen = len;
return val;
}
1 - integer overflow is possible on this line
2 - when 'len' variable overflows, buffer of small size will be allocated
3 - heap overflow on this line
Actions