--- mailman-2.1.5.1/misc/email-2.5.5/email/Message.py.CVE-2005-3573 2006-03-02 14:02:21.000000000 +0100 +++ mailman-2.1.5.1/misc/email-2.5.5/email/Message.py 2006-03-02 14:03:24.000000000 +0100 @@ -721,17 +721,20 @@ The filename is extracted from the Content-Disposition header's `filename' parameter, and it is unquoted. """ - missing = [] - filename = self.get_param('filename', missing, 'content-disposition') - if filename is missing: + try: + missing = [] + filename = self.get_param('filename', missing, 'content-disposition') + if filename is missing: + return failobj + if isinstance(filename, TupleType): + # It's an RFC 2231 encoded parameter + newvalue = _unquotevalue(filename) + return unicode(newvalue[2], newvalue[0] or 'us-ascii') + else: + newvalue = _unquotevalue(filename.strip()) + return newvalue + except: return failobj - if isinstance(filename, TupleType): - # It's an RFC 2231 encoded parameter - newvalue = _unquotevalue(filename) - return unicode(newvalue[2], newvalue[0] or 'us-ascii') - else: - newvalue = _unquotevalue(filename.strip()) - return newvalue def get_boundary(self, failobj=None): """Return the boundary associated with the payload if present.