Blame SOURCES/dovecot-2.3.13-CVE_2020_25275regr-part3.patch

2c808a
From a912198bdc38421ad84044089db84fc14c69c228 Mon Sep 17 00:00:00 2001
2c808a
From: Timo Sirainen <timo.sirainen@open-xchange.com>
2c808a
Date: Wed, 18 Nov 2020 21:22:45 +0200
2c808a
Subject: [PATCH] lib-imap: Fix writing BODYSTRUCTURE for truncated
2c808a
 multipart/digest part
2c808a
2c808a
Fixes error while parsing BODYSTRUCTURE:
2c808a
message_part message/rfc822 flag doesn't match lines in BODYSTRUCTURE
2c808a
---
2c808a
 src/lib-imap/imap-bodystructure.c      |  9 +++++++++
2c808a
 src/lib-imap/test-imap-bodystructure.c | 28 ++++++++++++++++++++++----
2c808a
 2 files changed, 33 insertions(+), 4 deletions(-)
2c808a
2c808a
diff --git a/src/lib-imap/imap-bodystructure.c b/src/lib-imap/imap-bodystructure.c
2c808a
index bfb6e64197..5d2e5a3a84 100644
2c808a
--- a/src/lib-imap/imap-bodystructure.c
2c808a
+++ b/src/lib-imap/imap-bodystructure.c
2c808a
@@ -161,6 +161,14 @@ static bool part_is_truncated(const struct message_part *part)
2c808a
 			   MESSAGE_PART_FLAG_MULTIPART. */
2c808a
 			return TRUE;
2c808a
 		}
2c808a
+	} else {
2c808a
+		/* No Content-Type */
2c808a
+		if (part->parent != NULL &&
2c808a
+		    (part->parent->flags & MESSAGE_PART_FLAG_MULTIPART_DIGEST) != 0) {
2c808a
+			/* Parent is MESSAGE_PART_FLAG_MULTIPART_DIGEST
2c808a
+			   (so this should have been message/rfc822). */
2c808a
+			return TRUE;
2c808a
+		}
2c808a
 	}
2c808a
 	return FALSE;
2c808a
 }
2c808a
@@ -195,6 +203,7 @@ static void part_write_body(const struct message_part *part,
2c808a
 			str_append_c(str, ' ');
2c808a
 			imap_append_string(str, data->content_subtype);
2c808a
 		}
2c808a
+		i_assert(text == ((part->flags & MESSAGE_PART_FLAG_TEXT) != 0));
2c808a
 	}
2c808a
 
2c808a
 	/* ("content type param key" "value" ...) */
2c808a
diff --git a/src/lib-imap/test-imap-bodystructure.c b/src/lib-imap/test-imap-bodystructure.c
2c808a
index 2118907e78..0f70cb0035 100644
2c808a
--- a/src/lib-imap/test-imap-bodystructure.c
2c808a
+++ b/src/lib-imap/test-imap-bodystructure.c
2c808a
@@ -381,13 +381,14 @@ static const unsigned int normalize_tests_count = N_ELEMENTS(normalize_tests);
2c808a
 
2c808a
 static struct message_part *
2c808a
 msg_parse(pool_t pool, const char *message, unsigned int max_nested_mime_parts,
2c808a
-	  bool parse_bodystructure)
2c808a
+	  unsigned int max_total_mime_parts, bool parse_bodystructure)
2c808a
 {
2c808a
 	const struct message_parser_settings parser_set = {
2c808a
 		.hdr_flags = MESSAGE_HEADER_PARSER_FLAG_SKIP_INITIAL_LWSP |
2c808a
 			MESSAGE_HEADER_PARSER_FLAG_DROP_CR,
2c808a
 		.flags = MESSAGE_PARSER_FLAG_SKIP_BODY_BLOCK,
2c808a
 		.max_nested_mime_parts = max_nested_mime_parts,
2c808a
+		.max_total_mime_parts = max_total_mime_parts,
2c808a
 	};
2c808a
 	struct message_parser_ctx *parser;
2c808a
 	struct istream *input;
2c808a
@@ -421,7 +422,7 @@ static void test_imap_bodystructure_write(void)
2c808a
 		pool_t pool = pool_alloconly_create("imap bodystructure write", 1024);
2c808a
 
2c808a
 		test_begin(t_strdup_printf("imap bodystructure write [%u]", i));
2c808a
-		parts = msg_parse(pool, test->message, 0, TRUE);
2c808a
+		parts = msg_parse(pool, test->message, 0, 0, TRUE);
2c808a
 
2c808a
 		imap_bodystructure_write(parts, str, TRUE);
2c808a
 		test_assert(strcmp(str_c(str), test->bodystructure) == 0);
2c808a
@@ -448,7 +449,7 @@ static void test_imap_bodystructure_parse(void)
2c808a
 		pool_t pool = pool_alloconly_create("imap bodystructure parse", 1024);
2c808a
 
2c808a
 		test_begin(t_strdup_printf("imap bodystructure parser [%u]", i));
2c808a
-		parts = msg_parse(pool, test->message, 0, FALSE);
2c808a
+		parts = msg_parse(pool, test->message, 0, 0, FALSE);
2c808a
 
2c808a
 		test_assert(imap_body_parse_from_bodystructure(test->bodystructure,
2c808a
 								     str, &error) == 0);
2c808a
@@ -515,7 +516,7 @@ static void test_imap_bodystructure_normalize(void)
2c808a
 		pool_t pool = pool_alloconly_create("imap bodystructure parse", 1024);
2c808a
 
2c808a
 		test_begin(t_strdup_printf("imap bodystructure normalize [%u]", i));
2c808a
-		parts = msg_parse(pool, test->message, 0, FALSE);
2c808a
+		parts = msg_parse(pool, test->message, 0, 0, FALSE);
2c808a
 
2c808a
 		ret = imap_bodystructure_parse(test->input,
2c808a
 							   pool, parts, &error);
2c808a
@@ -538,6 +539,7 @@ static const struct {
2c808a
 	const char *input;
2c808a
 	const char *bodystructure;
2c808a
 	unsigned int max_depth;
2c808a
+	unsigned int max_total;
2c808a
 } truncation_tests[] = {
2c808a
 	{
2c808a
 		.input = "Content-Type: message/rfc822\n"
2c808a
@@ -571,6 +573,23 @@ static const struct {
2c808a
 		.bodystructure = "(\"application\" \"octet-stream\" (\"boundary\" \"2\") NIL NIL \"7bit\" 63 NIL NIL NIL NIL) \"mixed\" (\"boundary\" \"1\") NIL NIL NIL",
2c808a
 		.max_depth = 2,
2c808a
 	},
2c808a
+	{
2c808a
+		.input = "Content-Type: multipart/digest; boundary=1\n"
2c808a
+			"\n"
2c808a
+			"--1\n"
2c808a
+			"\n"
2c808a
+			"Subject: hdr1\n"
2c808a
+			"\n"
2c808a
+			"body1\n"
2c808a
+			"--1\n"
2c808a
+			"\n"
2c808a
+			"Subject: hdr2\n"
2c808a
+			"\n"
2c808a
+			"body2\n",
2c808a
+		.bodystructure = "(\"application\" \"octet-stream\" NIL NIL NIL \"7bit\" 55 NIL NIL NIL NIL) \"digest\" (\"boundary\" \"1\") NIL NIL NIL",
2c808a
+		.max_total = 2,
2c808a
+	},
2c808a
+
2c808a
 };
2c808a
 
2c808a
 static void test_imap_bodystructure_truncation(void)
2c808a
@@ -590,6 +609,7 @@ static void test_imap_bodystructure_truncation(void)
2c808a
 
2c808a
 		parts = msg_parse(pool, truncation_tests[i].input,
2c808a
 				  truncation_tests[i].max_depth,
2c808a
+				  truncation_tests[i].max_total,
2c808a
 				  TRUE);
2c808a
 
2c808a
 		/* write out BODYSTRUCTURE and serialize message_parts */