@@ -1,3 +1,9 @@

+Mon Sep  1 19:31:08 CEST 2008 (tk)

+----------------------------------

+  * libclamav/message.c, mbox.c: fix out-of-memory null dereference in

+  mbox/message (bb#1141)

+  Patch from Edwin

+

 Mon Sep  1 19:27:55 CEST 2008 (tk)

 ----------------------------------

   * libclamav/chmunpack.c: fix possible invalid memory access (bb#1089)

@@ -1455,6 +1455,8 @@ cli_parse_mbox(const char *dir, int desc, cli_ctx *ctx)

 			}

 		}

+		if(body->isTruncated && retcode == CL_SUCCESS)

+			retcode = CL_EMEM;

 		/*

 		 * Tidy up and quit

 		 */

@@ -1617,6 +1619,11 @@ parseEmailFile(FILE *fin, const table_t *rfc821, const char *firstLine, const ch

 					}

 					fullline = cli_strdup(line);

 					fulllinelength = strlen(line) + 1;

+					if(!fullline) {

+						if(ret)

+							ret->isTruncated = TRUE;

+						break;

+					}

 				} else if(line != NULL) {

 					fulllinelength += strlen(line);

 					ptr = cli_realloc(fullline, fulllinelength);

@@ -1843,14 +1843,13 @@ messageToText(message *m)

 				for(t_line = messageGetBody(m); t_line; t_line = t_line->t_next) {

 					if(first == NULL)

 						first = last = cli_malloc(sizeof(text));

-					else {

+					else if (last) {

 						last->t_next = cli_malloc(sizeof(text));

 						last = last->t_next;

 					}

 					if(last == NULL) {

 						if(first) {

-							last->t_next = NULL;

 							textDestroy(first);

 						}

 						return NULL;

@@ -1864,7 +1863,8 @@ messageToText(message *m)

 			case UUENCODE:

 				cli_errmsg("messageToText: Unexpected attempt to handle uuencoded file - report to http://bugs.clamav.net\n");

 				if(first) {

-					last->t_next = NULL;

+					if(last)

+						last->t_next = NULL;

 					textDestroy(first);

 				}

 				return NULL;

@@ -1874,7 +1874,8 @@ messageToText(message *m)

 				if(t_line == NULL) {

 					/*cli_warnmsg("YENCODED attachment is missing begin statement\n");*/

 					if(first) {

-						last->t_next = NULL;

+						if(last)

+							last->t_next = NULL;

 						textDestroy(first);

 					}

 					return NULL;

@@ -1910,7 +1911,7 @@ messageToText(message *m)

 			if(first == NULL)

 				first = last = cli_malloc(sizeof(text));

-			else {

+			else if (last) {

 				last->t_next = cli_malloc(sizeof(text));

 				last = last->t_next;

 			}

@@ -1948,7 +1949,7 @@ messageToText(message *m)

 			if(decode(m, NULL, data, base64, FALSE) && data[0]) {

 				if(first == NULL)

 					first = last = cli_malloc(sizeof(text));

-				else {

+				else if (last) {

 					last->t_next = cli_malloc(sizeof(text));

 					last = last->t_next;

 				}

@@ -46,6 +46,7 @@ typedef struct message {

 	char	base64_1, base64_2, base64_3;

 	unsigned	int	isInfected : 1;

+	unsigned        int     isTruncated  : 1;

 } message;