Blame SOURCES/cyrus-imapd-3.0-CVE-2021-33582.patch

66e0cc
diff --git a/imap/http_dav.c b/imap/http_dav.c
66e0cc
index 91bbc28b6b..a6fa5c8345 100644
66e0cc
--- a/imap/http_dav.c
66e0cc
+++ b/imap/http_dav.c
66e0cc
@@ -5494,7 +5494,7 @@ EXPORTED int meth_propfind(struct transaction_t *txn, void *params)
66e0cc
     xmlDocPtr indoc = NULL, outdoc = NULL;
66e0cc
     xmlNodePtr root, cur = NULL, props = NULL;
66e0cc
     xmlNsPtr ns[NUM_NAMESPACE];
66e0cc
-    struct hash_table ns_table = { 0, NULL, NULL };
66e0cc
+    struct hash_table ns_table = HASH_TABLE_INITIALIZER;
66e0cc
     struct propfind_ctx fctx;
66e0cc
     struct propfind_entry_list *elist = NULL;
66e0cc
 
66e0cc
@@ -7900,7 +7900,7 @@ int meth_report(struct transaction_t *txn, void *params)
66e0cc
     xmlNodePtr inroot = NULL, outroot = NULL, cur, prop = NULL, props = NULL;
66e0cc
     const struct report_type_t *report = NULL;
66e0cc
     xmlNsPtr ns[NUM_NAMESPACE];
66e0cc
-    struct hash_table ns_table = { 0, NULL, NULL };
66e0cc
+    struct hash_table ns_table = HASH_TABLE_INITIALIZER;
66e0cc
     struct propfind_ctx fctx;
66e0cc
     struct propfind_entry_list *elist = NULL;
66e0cc
 
66e0cc
diff --git a/lib/hash.c b/lib/hash.c
66e0cc
index 9703142c3b..84f2e80d28 100644
66e0cc
--- a/lib/hash.c
66e0cc
+++ b/lib/hash.c
66e0cc
@@ -43,10 +43,11 @@ EXPORTED hash_table *construct_hash_table(hash_table *table, size_t size, int us
66e0cc
       assert(table);
66e0cc
       assert(size);
66e0cc
 
66e0cc
-      table->size  = size;
66e0cc
+      table->size = size;
66e0cc
+      table->seed = rand(); /* might be zero, that's okay */
66e0cc
 
66e0cc
       /* Allocate the table -- different for using memory pools and not */
66e0cc
-      if(use_mpool) {
66e0cc
+      if (use_mpool) {
66e0cc
           /* Allocate an initial memory pool for 32 byte keys + the hash table
66e0cc
            * + the buckets themselves */
66e0cc
           table->pool =
66e0cc
@@ -72,7 +73,7 @@ EXPORTED hash_table *construct_hash_table(hash_table *table, size_t size, int us
66e0cc
 
66e0cc
 EXPORTED void *hash_insert(const char *key, void *data, hash_table *table)
66e0cc
 {
66e0cc
-      unsigned val = strhash(key) % table->size;
66e0cc
+      unsigned val = strhash_seeded(table->seed, key) % table->size;
66e0cc
       bucket *ptr, *newptr;
66e0cc
       bucket **prev;
66e0cc
 
66e0cc
@@ -153,9 +154,14 @@ EXPORTED void *hash_insert(const char *key, void *data, hash_table *table)
66e0cc
 
66e0cc
 EXPORTED void *hash_lookup(const char *key, hash_table *table)
66e0cc
 {
66e0cc
-      unsigned val = strhash(key) % table->size;
66e0cc
+      unsigned val;
66e0cc
       bucket *ptr;
66e0cc
 
66e0cc
+      if (!table->size)
66e0cc
+          return NULL;
66e0cc
+
66e0cc
+      val = strhash_seeded(table->seed, key) % table->size;
66e0cc
+
66e0cc
       if (!(table->table)[val])
66e0cc
             return NULL;
66e0cc
 
66e0cc
@@ -178,8 +184,7 @@ EXPORTED void *hash_lookup(const char *key, hash_table *table)
66e0cc
  * since it will leak memory until you get rid of the entire hash table */
66e0cc
 EXPORTED void *hash_del(const char *key, hash_table *table)
66e0cc
 {
66e0cc
-      unsigned val = strhash(key) % table->size;
66e0cc
-      void *data;
66e0cc
+      unsigned val = strhash_seeded(table->seed, key) % table->size;
66e0cc
       bucket *ptr, *last = NULL;
66e0cc
 
66e0cc
       if (!(table->table)[val])
66e0cc
@@ -200,15 +205,10 @@ EXPORTED void *hash_del(const char *key, hash_table *table)
66e0cc
           int cmpresult = strcmp(key, ptr->key);
66e0cc
           if (!cmpresult)
66e0cc
           {
66e0cc
+              void *data = ptr->data;
66e0cc
               if (last != NULL )
66e0cc
               {
66e0cc
-                  data = ptr -> data;
66e0cc
                   last -> next = ptr -> next;
66e0cc
-                  if(!table->pool) {
66e0cc
-                      free(ptr->key);
66e0cc
-                      free(ptr);
66e0cc
-                  }
66e0cc
-                  return data;
66e0cc
               }
66e0cc
 
66e0cc
               /*
66e0cc
@@ -221,15 +221,15 @@ EXPORTED void *hash_del(const char *key, hash_table *table)
66e0cc
 
66e0cc
               else
66e0cc
               {
66e0cc
-                  data = ptr->data;
66e0cc
                   (table->table)[val] = ptr->next;
66e0cc
-                  if(!table->pool) {
66e0cc
-                      free(ptr->key);
66e0cc
-                      free(ptr);
66e0cc
-                  }
66e0cc
-                  return data;
66e0cc
               }
66e0cc
-          } else if (cmpresult < 0) {
66e0cc
+              if(!table->pool) {
66e0cc
+                  free(ptr->key);
66e0cc
+                  free(ptr);
66e0cc
+              }
66e0cc
+              return data;
66e0cc
+          }
66e0cc
+          if (cmpresult < 0) {
66e0cc
               /* its not here! */
66e0cc
               return NULL;
66e0cc
           }
66e0cc
diff --git a/lib/hash.h b/lib/hash.h
66e0cc
index 8051ac1760..cfa7da1ffa 100644
66e0cc
--- a/lib/hash.h
66e0cc
+++ b/lib/hash.h
66e0cc
@@ -3,10 +3,11 @@
66e0cc
 #define HASH__H
66e0cc
 
66e0cc
 #include <stddef.h>           /* For size_t     */
66e0cc
+#include <stdint.h>
66e0cc
 #include "mpool.h"
66e0cc
 #include "strarray.h"
66e0cc
 
66e0cc
-#define HASH_TABLE_INITIALIZER {0, NULL, NULL}
66e0cc
+#define HASH_TABLE_INITIALIZER {0, 0, NULL, NULL}
66e0cc
 
66e0cc
 /*
66e0cc
 ** A hash table consists of an array of these buckets.  Each bucket
66e0cc
@@ -32,6 +33,7 @@ typedef struct bucket {
66e0cc
 
66e0cc
 typedef struct hash_table {
66e0cc
     size_t size;
66e0cc
+    uint32_t seed;
66e0cc
     bucket **table;
66e0cc
     struct mpool *pool;
66e0cc
 } hash_table;
66e0cc
diff --git a/lib/strhash.c b/lib/strhash.c
66e0cc
index d7c1741d2a..1b3251db73 100644
66e0cc
--- a/lib/strhash.c
66e0cc
+++ b/lib/strhash.c
66e0cc
@@ -42,17 +42,32 @@
66e0cc
 
66e0cc
 #include "config.h"
66e0cc
 
66e0cc
-EXPORTED unsigned strhash(const char *string)
66e0cc
+#include "lib/strhash.h"
66e0cc
+
66e0cc
+/* The well-known djb2 algorithm (e.g. http://www.cse.yorku.ca/~oz/hash.html),
66e0cc
+ * with the addition of an optional seed to limit predictability.
66e0cc
+ *
66e0cc
+ * XXX return type 'unsigned' for back-compat to previous version, but
66e0cc
+ * XXX ought to be 'uint32_t'
66e0cc
+ */
66e0cc
+EXPORTED unsigned strhash_seeded_djb2(uint32_t seed, const char *string)
66e0cc
 {
66e0cc
-      unsigned ret_val = 0;
66e0cc
-      int i;
66e0cc
+    const unsigned char *ustr = (const unsigned char *) string;
66e0cc
+    unsigned hash = 5381;
66e0cc
+    int c;
66e0cc
 
66e0cc
-      while (*string)
66e0cc
-      {
66e0cc
-            i = (int) *string;
66e0cc
-            ret_val ^= i;
66e0cc
-            ret_val <<= 1;
66e0cc
-            string ++;
66e0cc
-      }
66e0cc
-      return ret_val;
66e0cc
+    if (seed) {
66e0cc
+        /* treat the bytes of the seed as a prefix to the string */
66e0cc
+        unsigned i;
66e0cc
+        for (i = 0; i < sizeof seed; i++) {
66e0cc
+            c = seed & 0xff;
66e0cc
+            hash = ((hash << 5) + hash) ^ c;
66e0cc
+            seed >>= 8;
66e0cc
+        }
66e0cc
+    }
66e0cc
+
66e0cc
+    while ((c = *ustr++))
66e0cc
+        hash = ((hash << 5) + hash) ^ c;
66e0cc
+
66e0cc
+    return hash;
66e0cc
 }
66e0cc
diff --git a/lib/strhash.h b/lib/strhash.h
66e0cc
index 34533fdffa..27339bb288 100644
66e0cc
--- a/lib/strhash.h
66e0cc
+++ b/lib/strhash.h
66e0cc
@@ -41,7 +41,11 @@
66e0cc
  */
66e0cc
 
66e0cc
 #ifndef _STRHASH_H_
66e0cc
+#include <stdint.h>
66e0cc
 
66e0cc
-unsigned strhash(const char *string);
66e0cc
+unsigned strhash_seeded_djb2(uint32_t seed, const char *string);
66e0cc
+
66e0cc
+#define strhash(in)             strhash_seeded_djb2((0),  (in))
66e0cc
+#define strhash_seeded(sd, in)  strhash_seeded_djb2((sd), (in))
66e0cc
 
66e0cc
 #endif /* _STRHASH_H_ */