Blame SOURCES/dovecot-2.3.13-CVE_2020_25275-part3.patch

b62b43
From 0386140f61f9ba62225e90b419215f72bba6ad8b Mon Sep 17 00:00:00 2001
b62b43
From: Timo Sirainen <timo.sirainen@open-xchange.com>
b62b43
Date: Mon, 17 Aug 2020 18:11:36 +0300
b62b43
Subject: [PATCH] imap: Use imap_parser_read_tag() and _read_command_name()
b62b43
b62b43
---
b62b43
 src/imap/imap-client.c | 33 ++++++++++++++++++++++-----------
b62b43
 1 file changed, 22 insertions(+), 11 deletions(-)
b62b43
b62b43
diff --git a/src/imap/imap-client.c b/src/imap/imap-client.c
b62b43
index 0bf03caa97..95e57dbf53 100644
b62b43
--- a/src/imap/imap-client.c
b62b43
+++ b/src/imap/imap-client.c
b62b43
@@ -1182,6 +1182,9 @@ client_command_failed_early(struct client_command_context **_cmd,
b62b43
 {
b62b43
 	struct client_command_context *cmd = *_cmd;
b62b43
 
b62b43
+	/* ignore the rest of this line */
b62b43
+	cmd->client->input_skip_line = TRUE;
b62b43
+
b62b43
 	io_loop_time_refresh();
b62b43
 	command_stats_start(cmd);
b62b43
 	client_send_command_error(cmd, error);
b62b43
@@ -1193,6 +1196,8 @@ static bool client_command_input(struct client_command_context *cmd)
b62b43
 {
b62b43
 	struct client *client = cmd->client;
b62b43
 	struct command *command;
b62b43
+	const char *tag, *name;
b62b43
+	int ret;
b62b43
 
b62b43
         if (cmd->func != NULL) {
b62b43
 		/* command is being executed - continue it */
b62b43
@@ -1207,27 +1212,33 @@ static bool client_command_input(struct client_command_context *cmd)
b62b43
 	}
b62b43
 
b62b43
 	if (cmd->tag == NULL) {
b62b43
-                cmd->tag = imap_parser_read_word(cmd->parser);
b62b43
-		if (cmd->tag == NULL)
b62b43
+		ret = imap_parser_read_tag(cmd->parser, &tag;;
b62b43
+		if (ret == 0)
b62b43
 			return FALSE; /* need more data */
b62b43
-		cmd->tag = p_strdup(cmd->pool, cmd->tag);
b62b43
+		if (ret < 0) {
b62b43
+			client_command_failed_early(&cmd, "Invalid tag.");
b62b43
+			return TRUE;
b62b43
+		}
b62b43
+		cmd->tag = p_strdup(cmd->pool, tag);
b62b43
 	}
b62b43
 
b62b43
 	if (cmd->name == NULL) {
b62b43
-		cmd->name = imap_parser_read_word(cmd->parser);
b62b43
-		if (cmd->name == NULL)
b62b43
+		ret = imap_parser_read_command_name(cmd->parser, &name);
b62b43
+		if (ret == 0)
b62b43
 			return FALSE; /* need more data */
b62b43
+		if (ret < 0) {
b62b43
+			client_command_failed_early(&cmd, "Invalid command name.");
b62b43
+			return TRUE;
b62b43
+		}
b62b43
 
b62b43
 		/* UID commands are a special case. better to handle them
b62b43
 		   here. */
b62b43
-		if (!cmd->uid && strcasecmp(cmd->name, "UID") == 0) {
b62b43
+		if (!cmd->uid && strcasecmp(name, "UID") == 0) {
b62b43
 			cmd->uid = TRUE;
b62b43
-			cmd->name = imap_parser_read_word(cmd->parser);
b62b43
-			if (cmd->name == NULL)
b62b43
-				return FALSE; /* need more data */
b62b43
+			return client_command_input(cmd);
b62b43
 		}
b62b43
-		cmd->name = !cmd->uid ? p_strdup(cmd->pool, cmd->name) :
b62b43
-			p_strconcat(cmd->pool, "UID ", cmd->name, NULL);
b62b43
+		cmd->name = !cmd->uid ? p_strdup(cmd->pool, name) :
b62b43
+			p_strconcat(cmd->pool, "UID ", name, NULL);
b62b43
 		client_command_init_finished(cmd);
b62b43
 		imap_refresh_proctitle();
b62b43
 	}