Fix buffer overrun

[claws.git] / src / plugins / clamd / libclamd / clamd-plugin.c

diff --git a/src/plugins/clamd/libclamd/clamd-plugin.c b/src/plugins/clamd/libclamd/clamd-plugin.c
index b11554d325c90f2519a4a26aeed60e73f23437d5..dd6148121753243b55f6b822e27ebc4380af5b19 100644 (file)
--- a/src/plugins/clamd/libclamd/clamd-plugin.c
+++ b/src/plugins/clamd/libclamd/clamd-plugin.c
@@ -285,7 +285,7 @@ static int create_socket() {
        struct sockaddr_in addr_i;
        struct hostent *hp;
 
-       int new_sock;
+       int new_sock = -1;
 
        /*debug_set_mode(TRUE);*/
        if (! Socket) {
@@ -369,6 +369,8 @@ Clamd_Stat clamd_init(Clamd_Socket* config) {
        }
        memset(buf, '\0', sizeof(buf));
        while ((n_read = read(sock, buf, BUFSIZ)) > 0) {
+               n_read = n_read < BUFSIZ ? n_read : BUFSIZ - 1;
+               buf[n_read] = '\0';
                if (buf[strlen(buf) - 1] == '\n')
                        buf[strlen(buf) - 1] = '\0';
                debug_print("Ping result: %s\n", buf);
@@ -388,7 +390,7 @@ Clamd_Stat clamd_init(Clamd_Socket* config) {
        }
        memset(buf, '\0', sizeof(buf));
         while ((n_read = read(sock, buf, sizeof(buf))) > 0) {
-           buf[sizeof(buf) - 1] = '\0';
+           buf[n_read] = '\0';
            if (buf[strlen(buf) - 1] == '\n')
                buf[strlen(buf) - 1] = '\0';
            debug_print("Version: %s\n", buf);
@@ -509,7 +511,6 @@ Clamd_Stat clamd_verify_email(const gchar* path, response* result) {
                        result->msg = g_strdup(tmp);
                        g_free(tmp);
                        debug_print("result: %s\n", result->msg);
-                       close(sock);
                        return stat;
                }
                debug_print("copy to buf: %s\n", tmp);
@@ -526,7 +527,8 @@ Clamd_Stat clamd_verify_email(const gchar* path, response* result) {
                g_free(command);
                memset(buf, '\0', sizeof(buf));
                while ((n_read = read(sock, buf, BUFSIZ)) > 0) {
-                       buf[sizeof(buf) - 1] = '\0';
+                       n_read = n_read < BUFSIZ ? n_read : BUFSIZ - 1;
+                       buf[n_read] = '\0';
                        if (buf[strlen(buf) - 1] == '\n')
                                buf[strlen(buf) - 1] = '\0';
                }