Blame SOURCES/dovecot-2.3.13-CVE_2020_25275regr-part1.patch

27f02a
From 530c1e950a1bb46ff4e4a7c8e4b7cd945ff28916 Mon Sep 17 00:00:00 2001
27f02a
From: Timo Sirainen <timo.sirainen@open-xchange.com>
27f02a
Date: Wed, 18 Nov 2020 18:55:34 +0200
27f02a
Subject: [PATCH] lib-imap: Fix writing BODYSTRUCTURE for truncated
27f02a
 message/rfc822 part
27f02a
27f02a
If the max nesting limit is reached, write the last part out as
27f02a
application/octet-stream instead of dummy message/rfc822.
27f02a
27f02a
Fixes error while parsing BODYSTRUCTURE:
27f02a
message_part message/rfc822 flag doesn't match BODYSTRUCTURE
27f02a
---
27f02a
 src/lib-imap/imap-bodystructure.c      | 54 +++++++++----------
27f02a
 src/lib-imap/test-imap-bodystructure.c | 73 ++++++++++++++++++++++++--
27f02a
 2 files changed, 96 insertions(+), 31 deletions(-)
27f02a
27f02a
diff --git a/src/lib-imap/imap-bodystructure.c b/src/lib-imap/imap-bodystructure.c
27f02a
index e3da1090b4..ab422c00d2 100644
27f02a
--- a/src/lib-imap/imap-bodystructure.c
27f02a
+++ b/src/lib-imap/imap-bodystructure.c
27f02a
@@ -142,31 +142,42 @@ static void part_write_body_multipart(const struct message_part *part,
27f02a
 	part_write_bodystructure_common(data, str);
27f02a
 }
27f02a
 
27f02a
+static bool part_is_truncated(const struct message_part *part)
27f02a
+{
27f02a
+	const struct message_part_data *data = part->data;
27f02a
+
27f02a
+	i_assert((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) == 0);
27f02a
+
27f02a
+	if (data->content_type != NULL) {
27f02a
+		if (strcasecmp(data->content_type, "message") == 0 &&
27f02a
+		    strcasecmp(data->content_subtype, "rfc822") == 0) {
27f02a
+			/* It's message/rfc822, but without
27f02a
+			   MESSAGE_PART_FLAG_MESSAGE_RFC822. */
27f02a
+			return TRUE;
27f02a
+		}
27f02a
+	}
27f02a
+	return FALSE;
27f02a
+}
27f02a
+
27f02a
 static void part_write_body(const struct message_part *part,
27f02a
 			    string_t *str, bool extended)
27f02a
 {
27f02a
 	const struct message_part_data *data = part->data;
27f02a
-	bool text, message_rfc822;
27f02a
+	bool text;
27f02a
 
27f02a
 	i_assert(part->data != NULL);
27f02a
 
27f02a
-	if ((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) != 0)
27f02a
-		message_rfc822 = TRUE;
27f02a
-	else if (data->content_type != NULL &&
27f02a
-		 strcasecmp(data->content_type, "message") == 0 &&
27f02a
-		 strcasecmp(data->content_subtype, "rfc822") == 0) {
27f02a
-		/* It's message/rfc822, but without
27f02a
-		   MESSAGE_PART_FLAG_MESSAGE_RFC822. That likely means maximum
27f02a
-		   MIME part count was reached while parsing the mail. Write
27f02a
-		   the missing child mail's ENVELOPE and BODY as empty dummy
27f02a
-		   values. */
27f02a
-		message_rfc822 = TRUE;
27f02a
-	} else
27f02a
-		message_rfc822 = FALSE;
27f02a
-
27f02a
-	if (message_rfc822) {
27f02a
+	if ((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) != 0) {
27f02a
 		str_append(str, "\"message\" \"rfc822\"");
27f02a
 		text = FALSE;
27f02a
+	} else if (part_is_truncated(part)) {
27f02a
+		/* Maximum MIME part count was reached while parsing the mail.
27f02a
+		   Write this part out as application/octet-stream instead.
27f02a
+		   We're not using text/plain, because it would require
27f02a
+		   message-parser to use MESSAGE_PART_FLAG_TEXT for this part
27f02a
+		   to avoid losing line count in message_part serialization. */
27f02a
+		str_append(str, "\"application\" \"octet-stream\"");
27f02a
+		text = FALSE;
27f02a
 	} else {
27f02a
 		/* "content type" "subtype" */
27f02a
 		if (data->content_type == NULL) {
27f02a
@@ -214,17 +225,6 @@ static void part_write_body(const struct message_part *part,
27f02a
 
27f02a
 		part_write_bodystructure_siblings(part->children, str, extended);
27f02a
 		str_printfa(str, " %u", part->body_size.lines);
27f02a
-	} else if (message_rfc822) {
27f02a
-		/* truncated MIME part - write out dummy values */
27f02a
-		i_assert(part->children == NULL);
27f02a
-
27f02a
-		str_append(str, " (NIL NIL NIL NIL NIL NIL NIL NIL NIL NIL) ");
27f02a
-
27f02a
-		if (!extended)
27f02a
-			str_append(str, EMPTY_BODY);
27f02a
-		else
27f02a
-			str_append(str, EMPTY_BODYSTRUCTURE);
27f02a
-		str_printfa(str, " %u", part->body_size.lines);
27f02a
 	}
27f02a
 
27f02a
 	if (!extended)
27f02a
diff --git a/src/lib-imap/test-imap-bodystructure.c b/src/lib-imap/test-imap-bodystructure.c
27f02a
index dfc9957488..6cb699e126 100644
27f02a
--- a/src/lib-imap/test-imap-bodystructure.c
27f02a
+++ b/src/lib-imap/test-imap-bodystructure.c
27f02a
@@ -4,6 +4,7 @@
27f02a
 #include "istream.h"
27f02a
 #include "str.h"
27f02a
 #include "message-part-data.h"
27f02a
+#include "message-part-serialize.h"
27f02a
 #include "message-parser.h"
27f02a
 #include "imap-bodystructure.h"
27f02a
 #include "test-common.h"
27f02a
@@ -379,12 +380,14 @@ struct normalize_test normalize_tests[] = {
27f02a
 static const unsigned int normalize_tests_count = N_ELEMENTS(normalize_tests);
27f02a
 
27f02a
 static struct message_part *
27f02a
-msg_parse(pool_t pool, const char *message, bool parse_bodystructure)
27f02a
+msg_parse(pool_t pool, const char *message, unsigned int max_nested_mime_parts,
27f02a
+	  bool parse_bodystructure)
27f02a
 {
27f02a
 	const struct message_parser_settings parser_set = {
27f02a
 		.hdr_flags = MESSAGE_HEADER_PARSER_FLAG_SKIP_INITIAL_LWSP |
27f02a
 			MESSAGE_HEADER_PARSER_FLAG_DROP_CR,
27f02a
 		.flags = MESSAGE_PARSER_FLAG_SKIP_BODY_BLOCK,
27f02a
+		.max_nested_mime_parts = max_nested_mime_parts,
27f02a
 	};
27f02a
 	struct message_parser_ctx *parser;
27f02a
 	struct istream *input;
27f02a
@@ -418,7 +421,7 @@ static void test_imap_bodystructure_write(void)
27f02a
 		pool_t pool = pool_alloconly_create("imap bodystructure write", 1024);
27f02a
 
27f02a
 		test_begin(t_strdup_printf("imap bodystructure write [%u]", i));
27f02a
-		parts = msg_parse(pool, test->message, TRUE);
27f02a
+		parts = msg_parse(pool, test->message, 0, TRUE);
27f02a
 
27f02a
 		imap_bodystructure_write(parts, str, TRUE);
27f02a
 		test_assert(strcmp(str_c(str), test->bodystructure) == 0);
27f02a
@@ -445,7 +448,7 @@ static void test_imap_bodystructure_parse(void)
27f02a
 		pool_t pool = pool_alloconly_create("imap bodystructure parse", 1024);
27f02a
 
27f02a
 		test_begin(t_strdup_printf("imap bodystructure parser [%u]", i));
27f02a
-		parts = msg_parse(pool, test->message, FALSE);
27f02a
+		parts = msg_parse(pool, test->message, 0, FALSE);
27f02a
 
27f02a
 		test_assert(imap_body_parse_from_bodystructure(test->bodystructure,
27f02a
 								     str, &error) == 0);
27f02a
@@ -512,7 +515,7 @@ static void test_imap_bodystructure_normalize(void)
27f02a
 		pool_t pool = pool_alloconly_create("imap bodystructure parse", 1024);
27f02a
 
27f02a
 		test_begin(t_strdup_printf("imap bodystructure normalize [%u]", i));
27f02a
-		parts = msg_parse(pool, test->message, FALSE);
27f02a
+		parts = msg_parse(pool, test->message, 0, FALSE);
27f02a
 
27f02a
 		ret = imap_bodystructure_parse(test->input,
27f02a
 							   pool, parts, &error);
27f02a
@@ -531,6 +534,67 @@ static void test_imap_bodystructure_normalize(void)
27f02a
 	} T_END;
27f02a
 }
27f02a
 
27f02a
+static const struct {
27f02a
+	const char *input;
27f02a
+	const char *bodystructure;
27f02a
+	unsigned int max_depth;
27f02a
+} truncation_tests[] = {
27f02a
+	{
27f02a
+		.input = "Content-Type: message/rfc822\n"
27f02a
+			"\n"
27f02a
+			"Content-Type: message/rfc822\n"
27f02a
+			"Header2: value2\n"
27f02a
+			"\n"
27f02a
+			"Subject: hello world\n"
27f02a
+			"Header2: value2\n"
27f02a
+			"Header3: value3\n"
27f02a
+			"\n"
27f02a
+			"body line 1\n"
27f02a
+			"body line 2\n"
27f02a
+			"body line 4\n"
27f02a
+			"body line 3\n",
27f02a
+		.bodystructure = "\"message\" \"rfc822\" NIL NIL NIL \"7bit\" 159 (NIL NIL NIL NIL NIL NIL NIL NIL NIL NIL) (\"application\" \"octet-stream\" NIL NIL NIL \"7bit\" 110 NIL NIL NIL NIL) 11 NIL NIL NIL NIL",
27f02a
+		.max_depth = 2,
27f02a
+	},
27f02a
+};
27f02a
+
27f02a
+static void test_imap_bodystructure_truncation(void)
27f02a
+{
27f02a
+	struct message_part *parts;
27f02a
+	const char *error;
27f02a
+	string_t *str_body = t_str_new(128);
27f02a
+	string_t *str_parts = t_str_new(128);
27f02a
+	pool_t pool = pool_alloconly_create("imap bodystructure parse", 1024);
27f02a
+
27f02a
+	test_begin("imap bodystructure truncation");
27f02a
+
27f02a
+	for (unsigned int i = 0; i < N_ELEMENTS(truncation_tests); i++) {
27f02a
+		p_clear(pool);
27f02a
+		str_truncate(str_body, 0);
27f02a
+		str_truncate(str_parts, 0);
27f02a
+
27f02a
+		parts = msg_parse(pool, truncation_tests[i].input,
27f02a
+				  truncation_tests[i].max_depth,
27f02a
+				  TRUE);
27f02a
+
27f02a
+		/* write out BODYSTRUCTURE and serialize message_parts */
27f02a
+		imap_bodystructure_write(parts, str_body, TRUE);
27f02a
+		message_part_serialize(parts, str_parts);
27f02a
+
27f02a
+		/* now deserialize message_parts and make sure they can be used
27f02a
+		   to parse BODYSTRUCTURE */
27f02a
+		parts = message_part_deserialize(pool, str_data(str_parts),
27f02a
+						 str_len(str_parts), &error);
27f02a
+		test_assert(parts != NULL);
27f02a
+		test_assert(imap_bodystructure_parse(str_c(str_body), pool,
27f02a
+						     parts, &error) == 0);
27f02a
+		test_assert_strcmp(str_c(str_body),
27f02a
+				   truncation_tests[i].bodystructure);
27f02a
+	}
27f02a
+	pool_unref(&pool);
27f02a
+	test_end();
27f02a
+}
27f02a
+
27f02a
 int main(void)
27f02a
 {
27f02a
 	static void (*const test_functions[])(void) = {
27f02a
@@ -538,6 +602,7 @@ int main(void)
27f02a
 		test_imap_bodystructure_parse,
27f02a
 		test_imap_bodystructure_normalize,
27f02a
 		test_imap_bodystructure_parse_full,
27f02a
+		test_imap_bodystructure_truncation,
27f02a
 		NULL
27f02a
 	};
27f02a
 	return test_run(test_functions);