(rmail-convert-to-babyl-format): Check Content-Length field for consistency.

1 files changed, 20 insertions, 3 deletions

diff --git a/lisp/mail/rmail.el b/lisp/mail/rmail.el
index 40ab9117264..057ae8f9804 100644
--- a/lisp/mail/rmail.el
+++ b/lisp/mail/rmail.el
@@ -928,9 +928,26 @@ argument causes us to read a file name and use that file as the inbox."
 					      header-end t)
 			      (let ((beg (point))
 				    (eol (progn (end-of-line) (point))))
-				(read (buffer-substring beg eol)))))))
-		 (and size (numberp size) (>= size 0)
-		      (goto-char (+ header-end size))))
+				(string-to-int (buffer-substring beg eol)))))))
+		 (and size
+		      (if (and (natnump size)
+			       (<= (+ header-end size) (point-max))
+			       ;; Make sure this would put us at a position
+			       ;; that we could continue from.
+			       (save-excursion
+				 (goto-char (+ header-end size))
+				 (skip-chars-forward "\n")
+				 (or (eobp)
+				     (and (looking-at "BABYL OPTIONS:")
+					  (search-forward "\n\^_" nil t))
+				     (and (looking-at "\^L")
+					  (search-forward "\n\^_" nil t))
+				     (let ((case-fold-search t))
+				       (looking-at mmdf-delim1))
+				     (looking-at "From "))))
+			  (goto-char (+ header-end size))
+			(message "Ignoring invalid Content-Length field")
+			(sit-for 1 0 t))))
 
 	       (if (re-search-forward
 		    (concat "^[\^_]?\\("