uw-imapd: vulnerabilities in IMAP clients written with C and C++

1. Handling huge literal sizes. Many clients do malloc(literal_size+1) and then read the literal into it. Problem is that if literal_size is UINT_MAX-1, the +1 overflows it into malloc(0) but server is still allowed to write UINT_MAX-1 bytes of data there. There may also be similiar problems if literal size is read into signed integer which causes it to become negative. Some clients use atoi(), so giving -1 as literal size is equilevant to giving UINT_MAX-1.

IMAP servers can also be vulnerable to this one if they're not careful.

2. Handling huge mailbox sizes (ie. huge value in EXISTS reply). Many clients do malloc(messages_count * sizeof(struct message)) and read data into it.

Read the full advisory for more information.