Blame SOURCES/dovecot-2.3.13-CVE_2020_25275-part8.patch

2c808a
From 266e54b7b8c34c9a58dd60a2e53c5ca7d1deae19 Mon Sep 17 00:00:00 2001
2c808a
From: Timo Sirainen <timo.sirainen@open-xchange.com>
2c808a
Date: Fri, 11 Sep 2020 10:57:51 +0300
2c808a
Subject: [PATCH] lib-imap: Don't generate invalid BODYSTRUCTURE when reaching
2c808a
 MIME part limit
2c808a
2c808a
If the last MIME part was message/rfc822 and its child was truncated away,
2c808a
BODYSTRUCTURE was missing the ENVELOPE and BODY[STRUCTURE] parts. Fixed by
2c808a
writing empty dummy ones.
2c808a
---
2c808a
 src/lib-imap/imap-bodystructure.c | 29 +++++++++++++++++++++++++++--
2c808a
 1 file changed, 27 insertions(+), 2 deletions(-)
2c808a
2c808a
diff --git a/src/lib-imap/imap-bodystructure.c b/src/lib-imap/imap-bodystructure.c
2c808a
index 4e379e56a9..e3da1090b4 100644
2c808a
--- a/src/lib-imap/imap-bodystructure.c
2c808a
+++ b/src/lib-imap/imap-bodystructure.c
2c808a
@@ -146,11 +146,25 @@ static void part_write_body(const struct message_part *part,
2c808a
 			    string_t *str, bool extended)
2c808a
 {
2c808a
 	const struct message_part_data *data = part->data;
2c808a
-	bool text;
2c808a
+	bool text, message_rfc822;
2c808a
 
2c808a
 	i_assert(part->data != NULL);
2c808a
 
2c808a
-	if ((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) != 0) {
2c808a
+	if ((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) != 0)
2c808a
+		message_rfc822 = TRUE;
2c808a
+	else if (data->content_type != NULL &&
2c808a
+		 strcasecmp(data->content_type, "message") == 0 &&
2c808a
+		 strcasecmp(data->content_subtype, "rfc822") == 0) {
2c808a
+		/* It's message/rfc822, but without
2c808a
+		   MESSAGE_PART_FLAG_MESSAGE_RFC822. That likely means maximum
2c808a
+		   MIME part count was reached while parsing the mail. Write
2c808a
+		   the missing child mail's ENVELOPE and BODY as empty dummy
2c808a
+		   values. */
2c808a
+		message_rfc822 = TRUE;
2c808a
+	} else
2c808a
+		message_rfc822 = FALSE;
2c808a
+
2c808a
+	if (message_rfc822) {
2c808a
 		str_append(str, "\"message\" \"rfc822\"");
2c808a
 		text = FALSE;
2c808a
 	} else {
2c808a
@@ -200,6 +214,17 @@ static void part_write_body(const struct message_part *part,
2c808a
 
2c808a
 		part_write_bodystructure_siblings(part->children, str, extended);
2c808a
 		str_printfa(str, " %u", part->body_size.lines);
2c808a
+	} else if (message_rfc822) {
2c808a
+		/* truncated MIME part - write out dummy values */
2c808a
+		i_assert(part->children == NULL);
2c808a
+
2c808a
+		str_append(str, " (NIL NIL NIL NIL NIL NIL NIL NIL NIL NIL) ");
2c808a
+
2c808a
+		if (!extended)
2c808a
+			str_append(str, EMPTY_BODY);
2c808a
+		else
2c808a
+			str_append(str, EMPTY_BODYSTRUCTURE);
2c808a
+		str_printfa(str, " %u", part->body_size.lines);
2c808a
 	}
2c808a
 
2c808a
 	if (!extended)