Comment 3 for bug 1011839

Revision history for this message
In , Paul (paul-redhat-bugs) wrote :

Created attachment 375822
Fix several issues in ytnef.c

0) This patch is the result of a discussion started at a evolution bugreport: https://bugzilla.gnome.org/show_bug.cgi?id=602177

1) The patch tries to fix these issues:
- SwapWord(), SwapDWord() and SwapDDWord() can return a pointer to a local value (in big endian mode). They can also be simplified (though some might argue with my idea of simple here);
- TNEFRendData() reads a 14 byte (packed) value in a TNEF stream as if it were a 16 byte (unpacked) struct;
- leaks related to MAPIProps->properties->propnames;
- buffer overflow in comp_Prebuf.data (in DecompressRTF()), fixed by a minor code reorganization;
- one "if branch" in DecompressRTF() should have a return (though I have no way to test what that return should be).

2) Note that the code (even with this patch) generates a lot of compiler warnings. I haven't really looked at those.

3) Upstream looks dead to me. If (something like) the patch is accepted will the packager contact other packagers (as the patch does fix a buffer overflow)? Or should (something like) the patch just be dropped as upstream's page (at sf.net)?