Blame SOURCES/dovecot-2.3.10-CVE_2020_10957p3.patch

311a5d
From 874817b169d19a4ae51d80ad5798a396bfe90136 Mon Sep 17 00:00:00 2001
311a5d
From: Stephan Bosch <stephan.bosch@open-xchange.com>
311a5d
Date: Tue, 24 Mar 2020 21:14:34 +0100
311a5d
Subject: [PATCH] lib-smtp: smtp-syntax - Do not allow NULL return parameters
311a5d
 for smtp_ehlo_line_parse().
311a5d
311a5d
---
311a5d
 src/lib-smtp/smtp-syntax.c | 39 +++++++++++++++++---------------------
311a5d
 1 file changed, 17 insertions(+), 22 deletions(-)
311a5d
311a5d
diff --git a/src/lib-smtp/smtp-syntax.c b/src/lib-smtp/smtp-syntax.c
311a5d
index 0b0a91ce07..5cca6c40fd 100644
311a5d
--- a/src/lib-smtp/smtp-syntax.c
311a5d
+++ b/src/lib-smtp/smtp-syntax.c
311a5d
@@ -249,12 +249,10 @@ static int smtp_parse_ehlo_line(struct smtp_parser *parser,
311a5d
 		(i_isalnum(*parser->cur) || *parser->cur == '-'))
311a5d
 		parser->cur++;
311a5d
 
311a5d
-	if (key_r != NULL)
311a5d
-		*key_r = p_strdup_until(parser->pool, pbegin, parser->cur);
311a5d
+	*key_r = p_strdup_until(parser->pool, pbegin, parser->cur);
311a5d
 
311a5d
 	if (parser->cur >= parser->end) {
311a5d
-		if (params_r != NULL)
311a5d
-			*params_r = p_new(parser->pool, const char *, 1);
311a5d
+		*params_r = p_new(parser->pool, const char *, 1);
311a5d
 		return 1;
311a5d
 	}
311a5d
 	if (*parser->cur != ' ') {
311a5d
@@ -264,18 +262,16 @@ static int smtp_parse_ehlo_line(struct smtp_parser *parser,
311a5d
 	parser->cur++;
311a5d
 
311a5d
 	pbegin = parser->cur;
311a5d
-	if (params_r != NULL)
311a5d
-		p_array_init(&params, parser->pool, 32);
311a5d
+	p_array_init(&params, parser->pool, 32);
311a5d
 	while (parser->cur < parser->end) {
311a5d
 		if (*parser->cur == ' ') {
311a5d
 			if (parser->cur+1 >= parser->end || *(parser->cur+1) == ' ') {
311a5d
 				parser->error = "Missing EHLO parameter after ' '";
311a5d
 				return -1;
311a5d
 			}
311a5d
-			if (params_r != NULL) {
311a5d
-				param = p_strdup_until(parser->pool, pbegin, parser->cur);
311a5d
-				array_push_back(&params, ¶m;;
311a5d
-			}
311a5d
+			param = p_strdup_until(parser->pool, pbegin,
311a5d
+					       parser->cur);
311a5d
+			array_push_back(&params, ¶m;;
311a5d
 			pbegin = parser->cur + 1;
311a5d
 		} else if (!smtp_char_is_ehlo_param(*parser->cur)) {
311a5d
 			parser->error = "Unexpected character in EHLO parameter";
311a5d
@@ -284,12 +280,10 @@ static int smtp_parse_ehlo_line(struct smtp_parser *parser,
311a5d
 		parser->cur++;
311a5d
 	}
311a5d
 
311a5d
-	if (params_r != NULL) {
311a5d
-		param = p_strdup_until(parser->pool, pbegin, parser->cur);
311a5d
-		array_push_back(&params, ¶m;;
311a5d
-		array_append_zero(&params);
311a5d
-		*params_r = array_front(&params);
311a5d
-	}
311a5d
+	param = p_strdup_until(parser->pool, pbegin, parser->cur);
311a5d
+	array_push_back(&params, ¶m;;
311a5d
+	array_append_zero(&params);
311a5d
+	*params_r = array_front(&params);
311a5d
 	return 1;
311a5d
 }
311a5d
 
311a5d
@@ -297,19 +291,20 @@ int smtp_ehlo_line_parse(const char *ehlo_line, const char **key_r,
311a5d
 	const char *const **params_r, const char **error_r)
311a5d
 {
311a5d
 	struct smtp_parser parser;
311a5d
-	int ret;
311a5d
+
311a5d
+	*key_r = NULL;
311a5d
+	*params_r = NULL;
311a5d
+	*error_r = NULL;
311a5d
 
311a5d
 	if (ehlo_line == NULL || *ehlo_line == '\0') {
311a5d
-		if (error_r != NULL)
311a5d
-			*error_r = "Parameter is empty";
311a5d
+		*error_r = "Parameter is empty";
311a5d
 		return -1;
311a5d
 	}
311a5d
 
311a5d
 	smtp_parser_init(&parser, pool_datastack_create(), ehlo_line);
311a5d
 
311a5d
-	if ((ret=smtp_parse_ehlo_line(&parser, key_r, params_r)) <= 0) {
311a5d
-		if (error_r != NULL)
311a5d
-			*error_r = parser.error;
311a5d
+	if (smtp_parse_ehlo_line(&parser, key_r, params_r) <= 0) {
311a5d
+		*error_r = parser.error;
311a5d
 		return -1;
311a5d
 	}
311a5d
 	return 1;