Blame SOURCES/dovecot-2.3.13-CVE_2020_25275regr-part2.patch

2c808a
From ec2c5ffde7a1ca63219d47831725599e7de76f7f Mon Sep 17 00:00:00 2001
2c808a
From: Timo Sirainen <timo.sirainen@open-xchange.com>
2c808a
Date: Wed, 18 Nov 2020 20:48:11 +0200
2c808a
Subject: [PATCH] lib-imap: Fix writing BODYSTRUCTURE for truncated multipart/
2c808a
 part
2c808a
2c808a
If the max nesting limit is reached, write the last part out as
2c808a
application/octet-stream. The original content-type could be confusing
2c808a
IMAP clients when they don't see any child parts.
2c808a
---
2c808a
 src/lib-imap/imap-bodystructure.c      |  6 ++++++
2c808a
 src/lib-imap/test-imap-bodystructure.c | 15 +++++++++++++++
2c808a
 2 files changed, 21 insertions(+)
2c808a
2c808a
diff --git a/src/lib-imap/imap-bodystructure.c b/src/lib-imap/imap-bodystructure.c
2c808a
index ab422c00d2..bfb6e64197 100644
2c808a
--- a/src/lib-imap/imap-bodystructure.c
2c808a
+++ b/src/lib-imap/imap-bodystructure.c
2c808a
@@ -147,6 +147,7 @@ static bool part_is_truncated(const struct message_part *part)
2c808a
 	const struct message_part_data *data = part->data;
2c808a
 
2c808a
 	i_assert((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) == 0);
2c808a
+	i_assert((part->flags & MESSAGE_PART_FLAG_MULTIPART) == 0);
2c808a
 
2c808a
 	if (data->content_type != NULL) {
2c808a
 		if (strcasecmp(data->content_type, "message") == 0 &&
2c808a
@@ -155,6 +156,11 @@ static bool part_is_truncated(const struct message_part *part)
2c808a
 			   MESSAGE_PART_FLAG_MESSAGE_RFC822. */
2c808a
 			return TRUE;
2c808a
 		}
2c808a
+		if (strcasecmp(data->content_type, "multipart") == 0) {
2c808a
+			/* It's multipart/, but without
2c808a
+			   MESSAGE_PART_FLAG_MULTIPART. */
2c808a
+			return TRUE;
2c808a
+		}
2c808a
 	}
2c808a
 	return FALSE;
2c808a
 }
2c808a
diff --git a/src/lib-imap/test-imap-bodystructure.c b/src/lib-imap/test-imap-bodystructure.c
2c808a
index 6cb699e126..2118907e78 100644
2c808a
--- a/src/lib-imap/test-imap-bodystructure.c
2c808a
+++ b/src/lib-imap/test-imap-bodystructure.c
2c808a
@@ -556,6 +556,21 @@ static const struct {
2c808a
 		.bodystructure = "\"message\" \"rfc822\" NIL NIL NIL \"7bit\" 159 (NIL NIL NIL NIL NIL NIL NIL NIL NIL NIL) (\"application\" \"octet-stream\" NIL NIL NIL \"7bit\" 110 NIL NIL NIL NIL) 11 NIL NIL NIL NIL",
2c808a
 		.max_depth = 2,
2c808a
 	},
2c808a
+	{
2c808a
+		.input = "Content-Type: multipart/mixed; boundary=1\n"
2c808a
+			"\n"
2c808a
+			"--1\n"
2c808a
+			"Content-Type: multipart/mixed; boundary=2\n"
2c808a
+			"\n"
2c808a
+			"--2\n"
2c808a
+			"Content-Type: multipart/mixed; boundary=3\n"
2c808a
+			"\n"
2c808a
+			"--3\n"
2c808a
+			"\n"
2c808a
+			"body\n",
2c808a
+		.bodystructure = "(\"application\" \"octet-stream\" (\"boundary\" \"2\") NIL NIL \"7bit\" 63 NIL NIL NIL NIL) \"mixed\" (\"boundary\" \"1\") NIL NIL NIL",
2c808a
+		.max_depth = 2,
2c808a
+	},
2c808a
 };
2c808a
 
2c808a
 static void test_imap_bodystructure_truncation(void)