Blame SOURCES/dovecot-2.3.13-CVE_2020_25275-part8.patch

b62b43
From 266e54b7b8c34c9a58dd60a2e53c5ca7d1deae19 Mon Sep 17 00:00:00 2001
b62b43
From: Timo Sirainen <timo.sirainen@open-xchange.com>
b62b43
Date: Fri, 11 Sep 2020 10:57:51 +0300
b62b43
Subject: [PATCH] lib-imap: Don't generate invalid BODYSTRUCTURE when reaching
b62b43
 MIME part limit
b62b43
b62b43
If the last MIME part was message/rfc822 and its child was truncated away,
b62b43
BODYSTRUCTURE was missing the ENVELOPE and BODY[STRUCTURE] parts. Fixed by
b62b43
writing empty dummy ones.
b62b43
---
b62b43
 src/lib-imap/imap-bodystructure.c | 29 +++++++++++++++++++++++++++--
b62b43
 1 file changed, 27 insertions(+), 2 deletions(-)
b62b43
b62b43
diff --git a/src/lib-imap/imap-bodystructure.c b/src/lib-imap/imap-bodystructure.c
b62b43
index 4e379e56a9..e3da1090b4 100644
b62b43
--- a/src/lib-imap/imap-bodystructure.c
b62b43
+++ b/src/lib-imap/imap-bodystructure.c
b62b43
@@ -146,11 +146,25 @@ static void part_write_body(const struct message_part *part,
b62b43
 			    string_t *str, bool extended)
b62b43
 {
b62b43
 	const struct message_part_data *data = part->data;
b62b43
-	bool text;
b62b43
+	bool text, message_rfc822;
b62b43
 
b62b43
 	i_assert(part->data != NULL);
b62b43
 
b62b43
-	if ((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) != 0) {
b62b43
+	if ((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) != 0)
b62b43
+		message_rfc822 = TRUE;
b62b43
+	else if (data->content_type != NULL &&
b62b43
+		 strcasecmp(data->content_type, "message") == 0 &&
b62b43
+		 strcasecmp(data->content_subtype, "rfc822") == 0) {
b62b43
+		/* It's message/rfc822, but without
b62b43
+		   MESSAGE_PART_FLAG_MESSAGE_RFC822. That likely means maximum
b62b43
+		   MIME part count was reached while parsing the mail. Write
b62b43
+		   the missing child mail's ENVELOPE and BODY as empty dummy
b62b43
+		   values. */
b62b43
+		message_rfc822 = TRUE;
b62b43
+	} else
b62b43
+		message_rfc822 = FALSE;
b62b43
+
b62b43
+	if (message_rfc822) {
b62b43
 		str_append(str, "\"message\" \"rfc822\"");
b62b43
 		text = FALSE;
b62b43
 	} else {
b62b43
@@ -200,6 +214,17 @@ static void part_write_body(const struct message_part *part,
b62b43
 
b62b43
 		part_write_bodystructure_siblings(part->children, str, extended);
b62b43
 		str_printfa(str, " %u", part->body_size.lines);
b62b43
+	} else if (message_rfc822) {
b62b43
+		/* truncated MIME part - write out dummy values */
b62b43
+		i_assert(part->children == NULL);
b62b43
+
b62b43
+		str_append(str, " (NIL NIL NIL NIL NIL NIL NIL NIL NIL NIL) ");
b62b43
+
b62b43
+		if (!extended)
b62b43
+			str_append(str, EMPTY_BODY);
b62b43
+		else
b62b43
+			str_append(str, EMPTY_BODYSTRUCTURE);
b62b43
+		str_printfa(str, " %u", part->body_size.lines);
b62b43
 	}
b62b43
 
b62b43
 	if (!extended)