@@ -1,3 +1,8 @@

+Thu Nov  3 22:33:20 CET 2005 (tk)

+---------------------------------

+  * libclamav/fsg.c: fix buffer size calculation in unfsg_133

+		     Reported by Zero Day Initiative (ZDI-CAN-004)

+

 Mon Oct 31 21:21:38 GMT 2005 (njh)

 ----------------------------------

   * libclamav/mbox.c:	Scan attachments that have no filename

@@ -235,7 +235,7 @@ int unfsg_133(char *source, char *dest, int ssize, int dsize, struct SECTION *se

   for (i = 0 ; i <= sectcount ; i++) {

     char *startd=tdst;

-    if ( unfsg(tsrc, tdst, tsrc - source + ssize, tdst - dest + dsize, &tsrc, &tdst) == -1 )

+    if ( unfsg(tsrc, tdst, ssize - (tsrc - source), dsize - (tdst - dest), &tsrc, &tdst) == -1 )

       return -1;

     /* RVA has been filled already in pe.c */