Re: heap overflow in procmail

[Jakub Wilk <jwilk () jwilk net>]

> > https://bugs.debian.org/769937
[...]
> The Debian bug report does not contain diagnosis of the type of 
> programming error that is triggering each crash, so it is not clear 
> how many CVE identifiers must be assigned.

There are two distinct buffer overflows:

* Off-by-one heap overflow when parsing addresses that have left angle 
bracket, then a comma, but no right angle bracket. For example: 
<moo () example com,

* Heap overflow when parsing addresses that end with backslash. For 
example: <moo () example com\

Credit goes to Jan Darmochwal for identifying the root causes.

--
Jakub Wilk