Re: [tpop3d-discuss] [PATCH] Corrupted TOP response with PIPELINING and tpop3d 1.5.3

[Martin Blapp]

Hi all,

It seems that the buffer routines had serious bugs and where never
tested with big input. If the sendbuf does reach the place of readpos
we overwrite unread unput and fail. The patch expands the buffer if the
write position in the buffer has reached the read position.

Martin

--- buffer.c    Thu Nov  6 02:19:27 2003
+++ buffer.c    Wed Feb  2 16:48:22 2005
@@ -220,4 +253,17 @@
  * a location returned by buffer_get_push_ptr. */
 void buffer_push_bytes(buffer B, const size_t num) {
     B->put = (B->put + num) % B->len;
+    /* check if we reached the readpos and expand buffer if necessary*/
+    if(num && (B->put == B->get)) {
+       char* newbuf;
+       newbuf = xmalloc(B->len*2);
+       if(B->put) bcopy(B->buf+B->put, newbuf, B->len - B->put);
+       if(B->put) bcopy(B->buf, newbuf+B->put, B->put);
+       else       bcopy(B->buf, newbuf+B->put, B->len);
+       B->get = 0;
+       B->put = B->len;
+       B->len = B->len*2;
+        xfree(B->buf);
+       B->buf = newbuf;
+    }
 }