Blame SOURCES/dovecot-2.2.36-cve2019_11500_part4of4.patch

c9ace8
From 4a299840cdb51f61f8d1ebc0210b19c40dfbc1cc Mon Sep 17 00:00:00 2001
c9ace8
From: Timo Sirainen <timo.sirainen@open-xchange.com>
c9ace8
Date: Fri, 17 May 2019 10:39:25 +0300
c9ace8
Subject: [PATCH 2/2] lib-managesieve: Make sure str_unescape() won't be
c9ace8
 writing past allocated memory
c9ace8
c9ace8
The previous commit should already prevent this, but this makes sure it
c9ace8
can't become broken in the future either. It makes the performance a tiny
c9ace8
bit worse, but that's not practically noticeable.
c9ace8
---
c9ace8
 src/lib-managesieve/managesieve-parser.c | 6 ++----
c9ace8
 1 file changed, 2 insertions(+), 4 deletions(-)
c9ace8
c9ace8
diff --git a/src/lib-managesieve/managesieve-parser.c b/src/lib-managesieve/managesieve-parser.c
c9ace8
index f5f9d323..dc7d1fa9 100644
c9ace8
--- a/src/lib-managesieve/managesieve-parser.c
c9ace8
+++ b/src/lib-managesieve/managesieve-parser.c
c9ace8
@@ -169,10 +169,8 @@ static void managesieve_parser_save_arg(struct managesieve_parser *parser,
c9ace8
 
c9ace8
 			/* remove the escapes */
c9ace8
 			if (parser->str_first_escape >= 0 &&
c9ace8
-				  (parser->flags & MANAGESIEVE_PARSE_FLAG_NO_UNESCAPE) == 0) {
c9ace8
-				/* -1 because we skipped the '"' prefix */
c9ace8
-				str_unescape(str + parser->str_first_escape-1);
c9ace8
-			}
c9ace8
+				  (parser->flags & MANAGESIEVE_PARSE_FLAG_NO_UNESCAPE) == 0)
c9ace8
+				(void)str_unescape(str);
c9ace8
 
c9ace8
 			arg->_data.str = str;
c9ace8
 			arg->str_len = strlen(str);
c9ace8
-- 
c9ace8
2.11.0
c9ace8