Patch: Escape character troubles (ITS#1753)

			================
Written by Hallvard B. Furuseth and placed into the public domain.
This software is not subject to any license of the University of Oslo.
			================

maildap could address buf[-1] if len was < 2.

REWRITE_SUBMATCH_ESCAPE is '%', not '\'.

librewrite and saslautz could walk past the end of a string which
ended with an escape character.

Hallvard B. Furuseth <h.b.furuseth@usit.uio.no>, April 2002.

diff --git a/clients/maildap/main.c b/clients/maildap/main.c
index 98b181740fd047e68e16ca7698bbcffe1a732352..f8fd75177937db816f1880d987099e558229dbe4 100644 (file)
--- a/clients/maildap/main.c
+++ b/clients/maildap/main.c
@@ -439,7 +439,7 @@ get_config_line( FILE *cf, int *lineno)
                        continue;
                if ( strspn( buf, " \t\n" ) == len )
                        continue;
-               if ( buf[len-2] == '\\' ) {
+               if ( len >= 2 && buf[len-2] == '\\' ) {
                        pos = len - 2;
                        room = sizeof(buf) - pos;
                        continue;

diff --git a/libraries/librewrite/map.c b/libraries/librewrite/map.c
index 2180d8907757164816ad4c23e19b8babe54a5fe2..8db54af13711b89701804bb6fdcf5a214cf20012 100644 (file)
--- a/libraries/librewrite/map.c
+++ b/libraries/librewrite/map.c
@@ -245,19 +245,20 @@ rewrite_map_parse(
        for ( p = string, cnt = 1; p[ 0 ] != '\0' && cnt > 0; p++ ) {
                if ( p[ 0 ] == REWRITE_SUBMATCH_ESCAPE ) {
                        /*
-                        * '\' marks the beginning of a new map
+                        * '%' marks the beginning of a new map
                         */
                        if ( p[ 1 ] == '{' ) {
                                cnt++;
                        /*
-                        * '\' followed by a digit may mark the beginning
+                        * '%' followed by a digit may mark the beginning
                         * of an old map
                         */
                        } else if ( isdigit( (unsigned char) p[ 1 ] ) && p[ 2 ] == '{' ) {
                                cnt++;
                                p++;
                        }
-                       p++;
+                       if ( p[ 1 ] != '\0' )
+                               p++;
                } else if ( p[ 0 ] == '}' ) {
                        cnt--;
                }

diff --git a/libraries/librewrite/parse.c b/libraries/librewrite/parse.c
index a8129c41aed5ecfd83b2bce50d2961282eff3beb..bc83e0594e575a6a0cc61c4ce12ec07ef05e0452 100644 (file)
--- a/libraries/librewrite/parse.c
+++ b/libraries/librewrite/parse.c
@@ -45,7 +45,7 @@ parse_line(
        }
        
        for ( begin = p;  p[ 0 ] != '\0'; p++ ) {
-               if ( p[ 0 ] == '\\' ) {
+               if ( p[ 0 ] == '\\' && p[ 1 ] != '\0' ) {
                        p++;
                } else if ( p[ 0 ] == '\'' || p[ 0 ] == '\"') {
                        if ( in_quoted_field && p[ 0 ] == quote ) {

diff --git a/libraries/librewrite/subst.c b/libraries/librewrite/subst.c
index 1024517463519212239e7985e28a8f1b6cd81b61..4c0bc411e0fa627c0d77084e2a116da33c635f06 100644 (file)
--- a/libraries/librewrite/subst.c
+++ b/libraries/librewrite/subst.c
@@ -53,7 +53,7 @@ rewrite_subst_compile(
        for ( p = begin = result, subs_len = 0; p[ 0 ] != '\0'; p++ ) {
                
                /*
-                * Keep only single escapes '\'
+                * Keep only single escapes '%'
                 */
                if ( p[ 0 ] != REWRITE_SUBMATCH_ESCAPE ) {
                        continue;

diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c
index 2f9ee9b74a12e514870cf7f731254c7ce675bb96..5c1d6505a6d50b534a7236575241650a257ab839 100644 (file)
--- a/servers/slapd/saslauthz.c
+++ b/servers/slapd/saslauthz.c
@@ -164,7 +164,7 @@ int slap_sasl_regexp_config( const char *match, const char *replace )
        reg->sr_offset[0] = -2;
        n = 1;
        for ( c = reg->sr_replace;       *c;  c++ ) {
-               if ( *c == '\\' ) {
+               if ( *c == '\\' && c[1] ) {
                        c++;
                        continue;
                }