generic-library/poco
1
0
Fork 0
mirror of https://github.com/pocoproject/poco.git synced 2025-06-11 08:32:14 +02:00
Code Issues Projects Releases Wiki Activity

fix(MailMessage): double free if Content-Disposition is empty

Browse Source
This commit is contained in:
Mikhail Khachayants 2024-09-12 22:22:01 +03:00 committed by Matej Kenda
parent 71a9bdafbd
commit cefab15f9f
3 changed files with 44 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Net/src/MailMessage.cpp
View File

@ -105,6 +105,12 @@ namespace
NameValueCollection::ConstIterator end = header.end();
bool added = false;
if (contentDisp.empty())
{
_pMsg->addContent(pPS, cte);
added = true;
}
static const auto lcContentDisposition = Poco::toLower(MailMessage::HEADER_CONTENT_DISPOSITION);
for (; it != end; ++it)
@ -122,12 +128,6 @@ namespace
pPS->headers().set(it->first, it->second);
}
if (contentDisp.empty())
{
_pMsg->addContent(pPS, cte);
added = true;
}
if (!added) delete pPS;
}
}

37
Net/testsuite/src/MailMessageTest.cpp
View File

@ -558,6 +558,42 @@ void MailMessageTest::testReadMultiPartMixedCaseHeaders()
}
void MailMessageTest::testReadMultiPartInvalidContentDisposition()
{
std::istringstream istr(
"Content-type: multipart/mixed; boundary=MIME_boundary_01234567\r\n"
"Date: Thu, 1 Jan 1970 00:00:00 GMT\r\n"
"From: poco@appinf.com\r\n"
"Mime-Version: 1.0\r\n"
"Subject: Test Message\r\n"
"To: John Doe <john.doe@no.where>\r\n"
"\r\n"
"\r\n"
"Hello World!\r\n"
"\r\n"
"--MIME_boundary_01234567\r\n"
"Content-Disposition: \r\n"
"Content-Transfer-Encoding: base64\r\n"
"Content-Type: application/octet-stream; name=sample\r\n"
"\r\n"
"VGhpcyBpcyBzb21lIGJpbmFyeSBkYXRhLiBSZWFsbHku\r\n"
"--MIME_boundary_01234567--\r\n"
);
MailMessage message;
MailInputStream mis(istr);
message.read(mis);
assertTrue (message.isMultipart());
assertTrue (message.parts().size() == 1);
assertTrue (message.get(MailMessage::HEADER_CONTENT_TYPE) == "multipart/mixed; boundary=MIME_boundary_01234567");
assertTrue (message.parts()[0].encoding == MailMessage::ContentTransferEncoding::ENCODING_BASE64);
assertTrue (message.parts()[0].disposition == MailMessage::ContentDisposition::CONTENT_INLINE);
assertTrue (message.parts()[0].pSource->headers().get(MailMessage::HEADER_CONTENT_TYPE) == "application/octet-stream; name=sample");
}
void MailMessageTest::testReadMultiPartNoFinalBoundaryFromFile()
{
std::string data(
@ -758,6 +794,7 @@ CppUnit::Test* MailMessageTest::suite()
CppUnit_addTest(pSuite, MailMessageTest, testReadMultiPart);
CppUnit_addTest(pSuite, MailMessageTest, testReadMultiPartDefaultTransferEncoding);
CppUnit_addTest(pSuite, MailMessageTest, testReadMultiPartMixedCaseHeaders);
CppUnit_addTest(pSuite, MailMessageTest, testReadMultiPartInvalidContentDisposition);
CppUnit_addTest(pSuite, MailMessageTest, testReadMultiPartNoFinalBoundaryFromFile);
CppUnit_addTest(pSuite, MailMessageTest, testReadWriteMultiPart);
CppUnit_addTest(pSuite, MailMessageTest, testReadWriteMultiPartStore);

1
Net/testsuite/src/MailMessageTest.h
View File

@ -38,6 +38,7 @@ public:
void testReadMultiPartWithAttachmentNames();
void testReadMultiPartDefaultTransferEncoding();
void testReadMultiPartMixedCaseHeaders();
void testReadMultiPartInvalidContentDisposition();
void testReadMultiPartNoFinalBoundaryFromFile();
void testEncodeWord();