Greetings!


I took a look at that flaw too... but I wonder if there is a good technique to groom the heap to get that allocation right before the objective data
.

There are some limits on using a MAIL cmd, first. First, you cannot use it if another MAIL cmd was successful within the same smtp_setup_msg().


The only way would be using RSET so you can use MAIL again, but it will free all the subsequent heap buffers and return yield to the specified on smtp_reset()
.

The only time in which uyou can send a MAIL cmd to alloc it'd be between the second part of the cmd sent in the first TLS session, and the initialization of the new TLS session.


Are u guys using any specific technique to groom the heap to get the chunk on that struct?


Good luck!


---
Harris Johnson