popmaildir: fix several grave bugs with using memory past end of malloc block

1 files changed, 25 insertions, 27 deletions

diff --git a/mailutils/popmaildir.c b/mailutils/popmaildir.c
index d2cc7c0b9..1a72b87c5 100644
--- a/mailutils/popmaildir.c
+++ b/mailutils/popmaildir.c
@@ -16,12 +16,14 @@ static void pop3_checkr(const char *fmt, const char *param, char **ret)
 {
 	const char *msg = command(fmt, param);
 	char *answer = xmalloc_fgetline(stdin);
-	if (answer && '+' == *answer) {
+	if (answer && '+' == answer[0]) {
 		if (timeout)
 			alarm(0);
-		if (ret)
-			*ret = answer+4; // skip "+OK "
-		else if (ENABLE_FEATURE_CLEAN_UP)
+		if (ret) {
+			// skip "+OK "
+			memmove(answer, answer + 4, strlen(answer) - 4);
+			*ret = answer;
+		} else
 			free(answer);
 		return;
 	}
@@ -94,31 +96,28 @@ int popmaildir_main(int argc UNUSED_PARAM, char **argv)
 
 	// authenticate (if no -s given)
 	if (!(opts & OPT_s)) {
-		// server supports APOP and we want it? -> use it
-		if ('<' == *buf && (opts & OPT_a)) {
-			md5_ctx_t md5;
-			// yes! compose <stamp><password>
+		// server supports APOP and we want it?
+		if ('<' == buf[0] && (opts & OPT_a)) {
+			union { // save a bit of stack
+				md5_ctx_t ctx;
+				char hex[16 * 2 + 1];
+			} md5;
+			uint32_t res[16 / 4];
+
 			char *s = strchr(buf, '>');
 			if (s)
-				strcpy(s+1, G.pass);
-			s = buf;
-			// get md5 sum of <stamp><password>
-			md5_begin(&md5);
-			md5_hash(s, strlen(s), &md5);
-			md5_end(s, &md5);
-			// NOTE: md5 struct contains enough space
-			// so we reuse md5 space instead of xzalloc(16*2+1)
-#define md5_hex ((uint8_t *)&md5)
-//			uint8_t *md5_hex = (uint8_t *)&md5;
-			*bin2hex((char *)md5_hex, s, 16) = '\0';
+				s[1] = '\0';
+			// get md5 sum of "<stamp>password" string
+			md5_begin(&md5.ctx);
+			md5_hash(buf, strlen(buf), &md5.ctx);
+			md5_hash(G.pass, strlen(G.pass), &md5.ctx);
+			md5_end(res, &md5.ctx);
+			*bin2hex(md5.hex, (char*)res, 16) = '\0';
 			// APOP
-			s = xasprintf("%s %s", G.user, md5_hex);
-#undef md5_hex
+			s = xasprintf("%s %s", G.user, md5.hex);
 			pop3_check("APOP %s", s);
-			if (ENABLE_FEATURE_CLEAN_UP) {
-				free(s);
-				free(buf-4); // buf is "+OK " away from malloc'ed string
-			}
+			free(s);
+			free(buf);
 		// server ignores APOP -> use simple text authentication
 		} else {
 			// USER
@@ -141,8 +140,7 @@ int popmaildir_main(int argc UNUSED_PARAM, char **argv)
 	// if atoi fails to convert buf into number it returns 0
 	// in this case the following loop simply will not be executed
 	nmsg = atoi(buf);
-	if (ENABLE_FEATURE_CLEAN_UP)
-		free(buf-4); // buf is "+OK " away from malloc'ed string
+	free(buf);
 
 	// loop through messages
 	retr = (opts & OPT_T) ? xasprintf("TOP %%u %u", opt_nlines) : "RETR %u";