Re: Fwd: report 1/3: buffer under-read in rfc2047.c lwslen()

[Kevin J. McCarthy]

On Thu, Jun 18, 2026 at 08:09:01AM +0800, Kevin J. McCarthy wrote:

From: Acts1631 <acts1631...@proton.me>
The lwslen() helper calculates the length of linear whitespace at the beginning 
of a string. It scans until the first non-whitespace character, then evaluates 
*(p - 1):

 for (; p < s + n; p++)
   if (!strchr(" \t\r\n", *p))
   {
     len = (size_t)(p - s);
     break;
   }
 if (strchr("\r\n", *(p-1)))
   len = (size_t)0;

However, the bug report is valid.  Mutt will under-read the buffer.

--
Kevin J. McCarthy
GPG Fingerprint: 8975 A9B3 3AA3 7910 385C  5308 ADEF 7684 8031 6BDA

This relies on 1) a invalid rfc2047 encodeed word (because the spec says there must be LWN) and 2) an obscure option being set, which defaults off.

signature.asc
Description: PGP signature