Blame SOURCES/dovecot-2.2.36-cve2019_11500_part4of4.patch

158b54
From 4a299840cdb51f61f8d1ebc0210b19c40dfbc1cc Mon Sep 17 00:00:00 2001
158b54
From: Timo Sirainen <timo.sirainen@open-xchange.com>
158b54
Date: Fri, 17 May 2019 10:39:25 +0300
158b54
Subject: [PATCH 2/2] lib-managesieve: Make sure str_unescape() won't be
158b54
 writing past allocated memory
158b54
158b54
The previous commit should already prevent this, but this makes sure it
158b54
can't become broken in the future either. It makes the performance a tiny
158b54
bit worse, but that's not practically noticeable.
158b54
---
158b54
 src/lib-managesieve/managesieve-parser.c | 6 ++----
158b54
 1 file changed, 2 insertions(+), 4 deletions(-)
158b54
158b54
diff --git a/src/lib-managesieve/managesieve-parser.c b/src/lib-managesieve/managesieve-parser.c
158b54
index f5f9d323..dc7d1fa9 100644
158b54
--- a/src/lib-managesieve/managesieve-parser.c
158b54
+++ b/src/lib-managesieve/managesieve-parser.c
158b54
@@ -169,10 +169,8 @@ static void managesieve_parser_save_arg(struct managesieve_parser *parser,
158b54
 
158b54
 			/* remove the escapes */
158b54
 			if (parser->str_first_escape >= 0 &&
158b54
-				  (parser->flags & MANAGESIEVE_PARSE_FLAG_NO_UNESCAPE) == 0) {
158b54
-				/* -1 because we skipped the '"' prefix */
158b54
-				str_unescape(str + parser->str_first_escape-1);
158b54
-			}
158b54
+				  (parser->flags & MANAGESIEVE_PARSE_FLAG_NO_UNESCAPE) == 0)
158b54
+				(void)str_unescape(str);
158b54
 
158b54
 			arg->_data.str = str;
158b54
 			arg->str_len = strlen(str);
158b54
-- 
158b54
2.11.0
158b54