? eds-mime-filter-crlf-buffer-overrun.patch
Index: camel/camel-mime-filter-crlf.c
===================================================================
RCS file: /cvs/gnome/evolution-data-server/camel/camel-mime-filter-crlf.c,v
retrieving revision 1.12
diff -u -p -r1.12 camel-mime-filter-crlf.c
--- camel/camel-mime-filter-crlf.c	31 Aug 2005 04:21:56 -0000	1.12
+++ camel/camel-mime-filter-crlf.c	2 Nov 2006 00:46:09 -0000
@@ -97,7 +97,11 @@ filter (CamelMimeFilter *f, char *in, si
 			*outptr++ = *inptr++;
 		}
 	} else {
-		camel_mime_filter_set_size (f, len, FALSE);
+		/* Output can "grow" by one byte if crlf->saw_cr was set as
+		 * a carry-over from the previous invocation. This will happen
+		 * in practice, as the input is processed in arbitrarily-sized
+		 * blocks. */
+		camel_mime_filter_set_size (f, len + 1, FALSE);
 		
 		outptr = f->outbuf;
 		while (inptr < inend) {
