dovecot/dovecot-2.2.26-CVE-2016-8652a.patch

29 lines
1.1 KiB
Diff

From 1f2c35da2b96905bec6e45f88af0f33ee63789e6 Mon Sep 17 00:00:00 2001
From: Aki Tuomi <aki.tuomi@dovecot.fi>
Date: Wed, 23 Nov 2016 13:16:19 +0200
Subject: [PATCH] auth: Fix auth-policy crash when username is NULL
If SASL request is invalid, or incomplete, and username
is left NULL, handle it gracefully by adding just
NUL byte in auth policy digest for username.
---
src/auth/auth-policy.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/src/auth/auth-policy.c b/src/auth/auth-policy.c
index c7faa3c..86b31f1 100755
--- a/src/auth/auth-policy.c
+++ b/src/auth/auth-policy.c
@@ -442,7 +442,10 @@ void auth_policy_create_json(struct policy_lookup_ctx *context,
context->set->policy_hash_nonce,
strlen(context->set->policy_hash_nonce));
/* use +1 to make sure \0 gets included */
- digest->loop(ctx, context->request->user, strlen(context->request->user) + 1);
+ if (context->request->user == NULL)
+ digest->loop(ctx, "\0", 1);
+ else
+ digest->loop(ctx, context->request->user, strlen(context->request->user) + 1);
if (password != NULL)
digest->loop(ctx, password, strlen(password));
ptr = (unsigned char*)str_c_modifiable(buffer);