@@ -1,3 +1,9 @@

+Sun Feb 15 12:52:25 CET 2004 (tk)

+---------------------------------

+  * freshclam: fixed proxy user/pass buffer overflow (it was causing

+	       problems with HTTPProxy* directives). Thanks to

+	       Bill Maidment <bill*maidment.com.au>.

+

 Sun Feb 15 08:50:21 GMT 2004 (njh)

 ----------------------------------

   * libclamav:	added blobClose and blobCmp to reduce likelyhood of scanning the

@@ -359,7 +359,7 @@ struct cl_cvd *remote_cvdhead(const char *file, int socketfd, const char *hostna

         if(user) {

             int len;

-	    char* buf = mmalloc(strlen(user)*2+4);

+	    char* buf = mmalloc((strlen(pass) + strlen(user)) * 2 + 4);

 	    char *userpass = mmalloc(strlen(user) + strlen(pass) + 2);

 	    sprintf(userpass, "%s:%s", user, pass);

             len=fmt_base64(buf,userpass,strlen(userpass));

@@ -457,7 +457,7 @@ int get_database(const char *dbfile, int socketfd, const char *file, const char

         if(user) {

             int len;

-	    char* buf = mmalloc(strlen(user)*2+4);

+	    char* buf = mmalloc((strlen(pass) + strlen(user)) * 2 + 4);

 	    char *userpass = mmalloc(strlen(user) + strlen(pass) + 2);

 	    sprintf(userpass, "%s:%s", user, pass);

             len=fmt_base64(buf,userpass,strlen(userpass));