Blame SOURCES/dovecot-2.2.36-cve2019_11500_part4of4.patch

af53bc
From 4a299840cdb51f61f8d1ebc0210b19c40dfbc1cc Mon Sep 17 00:00:00 2001
af53bc
From: Timo Sirainen <timo.sirainen@open-xchange.com>
af53bc
Date: Fri, 17 May 2019 10:39:25 +0300
af53bc
Subject: [PATCH 2/2] lib-managesieve: Make sure str_unescape() won't be
af53bc
 writing past allocated memory
af53bc
af53bc
The previous commit should already prevent this, but this makes sure it
af53bc
can't become broken in the future either. It makes the performance a tiny
af53bc
bit worse, but that's not practically noticeable.
af53bc
---
af53bc
 src/lib-managesieve/managesieve-parser.c | 6 ++----
af53bc
 1 file changed, 2 insertions(+), 4 deletions(-)
af53bc
af53bc
diff --git a/src/lib-managesieve/managesieve-parser.c b/src/lib-managesieve/managesieve-parser.c
af53bc
index f5f9d323..dc7d1fa9 100644
af53bc
--- a/src/lib-managesieve/managesieve-parser.c
af53bc
+++ b/src/lib-managesieve/managesieve-parser.c
af53bc
@@ -169,10 +169,8 @@ static void managesieve_parser_save_arg(struct managesieve_parser *parser,
af53bc
 
af53bc
 			/* remove the escapes */
af53bc
 			if (parser->str_first_escape >= 0 &&
af53bc
-				  (parser->flags & MANAGESIEVE_PARSE_FLAG_NO_UNESCAPE) == 0) {
af53bc
-				/* -1 because we skipped the '"' prefix */
af53bc
-				str_unescape(str + parser->str_first_escape-1);
af53bc
-			}
af53bc
+				  (parser->flags & MANAGESIEVE_PARSE_FLAG_NO_UNESCAPE) == 0)
af53bc
+				(void)str_unescape(str);
af53bc
 
af53bc
 			arg->_data.str = str;
af53bc
 			arg->str_len = strlen(str);
af53bc
-- 
af53bc
2.11.0
af53bc