Opened 6 years ago

Closed 6 years ago

#9881 closed bug (fixed)

[Mail kit] MailAttachment.cpp: Size argument is greater than the length of the destination buffer

Reported by: mt Owned by: czeidler
Priority: normal Milestone: R1
Component: Kits/Mail Kit Version: R1/Development
Keywords: Cc:
Blocked By: Blocking:
Has a Patch: yes Platform: All

Description

In BAttributedMailAttachment::SaveToDisk(), array "name" size (255) is small for strncpy(text, fileName, B_FILE_NAME_LENGTH) in BSimpleMailAttachment::FileName(). Please see attached report.

Attachments (2)

0011-Fix-size-argument-is-greater-than-the-length-of-the-.patch (753 bytes ) - added by mt 6 years ago.
Patch
report-mq2NP5.html (90.4 KB ) - added by mt 6 years ago.
Report by Clang Static Analyzer

Download all attachments as: .zip

Change History (4)

comment:1 by mt, 6 years ago

Has a Patch: set

by mt, 6 years ago

Attachment: report-mq2NP5.html added

Report by Clang Static Analyzer

comment:2 by mmadia, 6 years ago

Resolution: fixed
Status: newclosed

Thanks for the patch! Applied hrev46347.

On the haiku-development list, Axel pointed out that the "+1" is not needed; B_FILE_NAME_LENGTH already includes the terminating null byte.

Note: See TracTickets for help on using tickets.