my_memmem(): fixed buffer overrun.

git-svn-id: svn://sylpheed.sraoss.jp/sylpheed/trunk@1922 ee746299-78ed-0310-b773-934348b2243d

3 files changed, 15 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index ce19cafa..12ada46f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2007-11-08
+
+	* libsylph/utils.c: my_memmem(): fixed buffer overrun bug (though
+	  unused).
+
 2007-10-11
 
 	* src/messageview.c: messageview_set_menu_state(): disable
diff --git a/ChangeLog.ja b/ChangeLog.ja
index 4cd6c717..f23833a4 100644
--- a/ChangeLog.ja
+++ b/ChangeLog.ja
@@ -1,3 +1,8 @@
+2007-11-08
+
+	* libsylph/utils.c: my_memmem(): バッファオーバーランバグを修正
+	  (ただし未使用)。
+
 2007-10-11
 
 	* src/messageview.c: messageview_set_menu_state(): 送信フォルダ以外で
diff --git a/libsylph/utils.c b/libsylph/utils.c
index b4db125f..fddd0433 100644
--- a/libsylph/utils.c
+++ b/libsylph/utils.c
@@ -398,18 +398,21 @@ gpointer my_memmem(gconstpointer haystack, size_t haystacklen,
 	const gchar *haystack_ = (const gchar *)haystack;
 	const gchar *needle_ = (const gchar *)needle;
 	const gchar *haystack_cur = (const gchar *)haystack;
+	size_t haystack_left = haystacklen;
 
 	if (needlelen == 1)
 		return memchr(haystack_, *needle_, haystacklen);
 
-	while ((haystack_cur = memchr(haystack_cur, *needle_, haystacklen))
+	while ((haystack_cur = memchr(haystack_cur, *needle_, haystack_left))
 	       != NULL) {
 		if (haystacklen - (haystack_cur - haystack_) < needlelen)
 			break;
 		if (memcmp(haystack_cur + 1, needle_ + 1, needlelen - 1) == 0)
 			return (gpointer)haystack_cur;
-		else
+		else {
 			haystack_cur++;
+			haystack_left = haystacklen - (haystack_cur - haystack_);
+		}
 	}
 
 	return NULL;