Blame SOURCES/dovecot-2.3.13-CVE_2020_25275-part8.patch

27f02a
From 266e54b7b8c34c9a58dd60a2e53c5ca7d1deae19 Mon Sep 17 00:00:00 2001
27f02a
From: Timo Sirainen <timo.sirainen@open-xchange.com>
27f02a
Date: Fri, 11 Sep 2020 10:57:51 +0300
27f02a
Subject: [PATCH] lib-imap: Don't generate invalid BODYSTRUCTURE when reaching
27f02a
 MIME part limit
27f02a
27f02a
If the last MIME part was message/rfc822 and its child was truncated away,
27f02a
BODYSTRUCTURE was missing the ENVELOPE and BODY[STRUCTURE] parts. Fixed by
27f02a
writing empty dummy ones.
27f02a
---
27f02a
 src/lib-imap/imap-bodystructure.c | 29 +++++++++++++++++++++++++++--
27f02a
 1 file changed, 27 insertions(+), 2 deletions(-)
27f02a
27f02a
diff --git a/src/lib-imap/imap-bodystructure.c b/src/lib-imap/imap-bodystructure.c
27f02a
index 4e379e56a9..e3da1090b4 100644
27f02a
--- a/src/lib-imap/imap-bodystructure.c
27f02a
+++ b/src/lib-imap/imap-bodystructure.c
27f02a
@@ -146,11 +146,25 @@ static void part_write_body(const struct message_part *part,
27f02a
 			    string_t *str, bool extended)
27f02a
 {
27f02a
 	const struct message_part_data *data = part->data;
27f02a
-	bool text;
27f02a
+	bool text, message_rfc822;
27f02a
 
27f02a
 	i_assert(part->data != NULL);
27f02a
 
27f02a
-	if ((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) != 0) {
27f02a
+	if ((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) != 0)
27f02a
+		message_rfc822 = TRUE;
27f02a
+	else if (data->content_type != NULL &&
27f02a
+		 strcasecmp(data->content_type, "message") == 0 &&
27f02a
+		 strcasecmp(data->content_subtype, "rfc822") == 0) {
27f02a
+		/* It's message/rfc822, but without
27f02a
+		   MESSAGE_PART_FLAG_MESSAGE_RFC822. That likely means maximum
27f02a
+		   MIME part count was reached while parsing the mail. Write
27f02a
+		   the missing child mail's ENVELOPE and BODY as empty dummy
27f02a
+		   values. */
27f02a
+		message_rfc822 = TRUE;
27f02a
+	} else
27f02a
+		message_rfc822 = FALSE;
27f02a
+
27f02a
+	if (message_rfc822) {
27f02a
 		str_append(str, "\"message\" \"rfc822\"");
27f02a
 		text = FALSE;
27f02a
 	} else {
27f02a
@@ -200,6 +214,17 @@ static void part_write_body(const struct message_part *part,
27f02a
 
27f02a
 		part_write_bodystructure_siblings(part->children, str, extended);
27f02a
 		str_printfa(str, " %u", part->body_size.lines);
27f02a
+	} else if (message_rfc822) {
27f02a
+		/* truncated MIME part - write out dummy values */
27f02a
+		i_assert(part->children == NULL);
27f02a
+
27f02a
+		str_append(str, " (NIL NIL NIL NIL NIL NIL NIL NIL NIL NIL) ");
27f02a
+
27f02a
+		if (!extended)
27f02a
+			str_append(str, EMPTY_BODY);
27f02a
+		else
27f02a
+			str_append(str, EMPTY_BODYSTRUCTURE);
27f02a
+		str_printfa(str, " %u", part->body_size.lines);
27f02a
 	}
27f02a
 
27f02a
 	if (!extended)