dovecot/SOURCES/dovecot-2.3.10-CVE_2020_10957p1.patch
2021-09-09 16:10:28 +00:00

61 lines
2.0 KiB
Diff

From 606724bd528b92347dce580d3ab48fc1e3c2f4d7 Mon Sep 17 00:00:00 2001
From: Stephan Bosch <stephan.bosch@open-xchange.com>
Date: Tue, 24 Mar 2020 20:57:03 +0100
Subject: [PATCH] lib-smtp: smtp-syntax - Do not allow NULL return parameters
for smtp_string_parse().
---
src/lib-smtp/smtp-server-cmd-noop.c | 8 ++++++--
src/lib-smtp/smtp-syntax.c | 9 +++++----
2 files changed, 11 insertions(+), 6 deletions(-)
diff --git a/src/lib-smtp/smtp-server-cmd-noop.c b/src/lib-smtp/smtp-server-cmd-noop.c
index 4986f800c8..550d709eab 100644
--- a/src/lib-smtp/smtp-server-cmd-noop.c
+++ b/src/lib-smtp/smtp-server-cmd-noop.c
@@ -13,11 +13,15 @@ void smtp_server_cmd_noop(struct smtp_server_cmd_ctx *cmd,
struct smtp_server_connection *conn = cmd->conn;
struct smtp_server_command *command = cmd->cmd;
const struct smtp_server_callbacks *callbacks = conn->callbacks;
+ const char *param, *error;
int ret;
/* "NOOP" [ SP String ] CRLF */
- if (*params != '\0' && smtp_string_parse(params, NULL, NULL) < 0) {
- smtp_server_reply(cmd, 501, "5.5.4", "Invalid parameters");
+ ret = smtp_string_parse(params, &param, &error);
+ if (ret < 0) {
+ smtp_server_reply(cmd, 501, "5.5.4",
+ "Invalid string parameter: %s",
+ error);
return;
}
diff --git a/src/lib-smtp/smtp-syntax.c b/src/lib-smtp/smtp-syntax.c
index 5d22445f72..6826682af1 100644
--- a/src/lib-smtp/smtp-syntax.c
+++ b/src/lib-smtp/smtp-syntax.c
@@ -17,7 +17,9 @@ int smtp_string_parse(const char *string,
const char **value_r, const char **error_r)
{
struct smtp_parser parser;
- int ret;
+
+ *value_r = NULL;
+ *error_r = NULL;
if (string == NULL || *string == '\0') {
*value_r = "";
@@ -26,9 +28,8 @@ int smtp_string_parse(const char *string,
smtp_parser_init(&parser, pool_datastack_create(), string);
- if ((ret=smtp_parser_parse_string(&parser, value_r)) < 0) {
- if (error_r != NULL)
- *error_r = parser.error;
+ if (smtp_parser_parse_string(&parser, value_r) < 0) {
+ *error_r = parser.error;
return -1;
}
if (parser.cur < parser.end) {