Blame SOURCES/dovecot-2.3.13-CVE_2020_25275regr-part1.patch

b62b43
From 530c1e950a1bb46ff4e4a7c8e4b7cd945ff28916 Mon Sep 17 00:00:00 2001
b62b43
From: Timo Sirainen <timo.sirainen@open-xchange.com>
b62b43
Date: Wed, 18 Nov 2020 18:55:34 +0200
b62b43
Subject: [PATCH] lib-imap: Fix writing BODYSTRUCTURE for truncated
b62b43
 message/rfc822 part
b62b43
b62b43
If the max nesting limit is reached, write the last part out as
b62b43
application/octet-stream instead of dummy message/rfc822.
b62b43
b62b43
Fixes error while parsing BODYSTRUCTURE:
b62b43
message_part message/rfc822 flag doesn't match BODYSTRUCTURE
b62b43
---
b62b43
 src/lib-imap/imap-bodystructure.c      | 54 +++++++++----------
b62b43
 src/lib-imap/test-imap-bodystructure.c | 73 ++++++++++++++++++++++++--
b62b43
 2 files changed, 96 insertions(+), 31 deletions(-)
b62b43
b62b43
diff --git a/src/lib-imap/imap-bodystructure.c b/src/lib-imap/imap-bodystructure.c
b62b43
index e3da1090b4..ab422c00d2 100644
b62b43
--- a/src/lib-imap/imap-bodystructure.c
b62b43
+++ b/src/lib-imap/imap-bodystructure.c
b62b43
@@ -142,31 +142,42 @@ static void part_write_body_multipart(const struct message_part *part,
b62b43
 	part_write_bodystructure_common(data, str);
b62b43
 }
b62b43
 
b62b43
+static bool part_is_truncated(const struct message_part *part)
b62b43
+{
b62b43
+	const struct message_part_data *data = part->data;
b62b43
+
b62b43
+	i_assert((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) == 0);
b62b43
+
b62b43
+	if (data->content_type != NULL) {
b62b43
+		if (strcasecmp(data->content_type, "message") == 0 &&
b62b43
+		    strcasecmp(data->content_subtype, "rfc822") == 0) {
b62b43
+			/* It's message/rfc822, but without
b62b43
+			   MESSAGE_PART_FLAG_MESSAGE_RFC822. */
b62b43
+			return TRUE;
b62b43
+		}
b62b43
+	}
b62b43
+	return FALSE;
b62b43
+}
b62b43
+
b62b43
 static void part_write_body(const struct message_part *part,
b62b43
 			    string_t *str, bool extended)
b62b43
 {
b62b43
 	const struct message_part_data *data = part->data;
b62b43
-	bool text, message_rfc822;
b62b43
+	bool text;
b62b43
 
b62b43
 	i_assert(part->data != NULL);
b62b43
 
b62b43
-	if ((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) != 0)
b62b43
-		message_rfc822 = TRUE;
b62b43
-	else if (data->content_type != NULL &&
b62b43
-		 strcasecmp(data->content_type, "message") == 0 &&
b62b43
-		 strcasecmp(data->content_subtype, "rfc822") == 0) {
b62b43
-		/* It's message/rfc822, but without
b62b43
-		   MESSAGE_PART_FLAG_MESSAGE_RFC822. That likely means maximum
b62b43
-		   MIME part count was reached while parsing the mail. Write
b62b43
-		   the missing child mail's ENVELOPE and BODY as empty dummy
b62b43
-		   values. */
b62b43
-		message_rfc822 = TRUE;
b62b43
-	} else
b62b43
-		message_rfc822 = FALSE;
b62b43
-
b62b43
-	if (message_rfc822) {
b62b43
+	if ((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) != 0) {
b62b43
 		str_append(str, "\"message\" \"rfc822\"");
b62b43
 		text = FALSE;
b62b43
+	} else if (part_is_truncated(part)) {
b62b43
+		/* Maximum MIME part count was reached while parsing the mail.
b62b43
+		   Write this part out as application/octet-stream instead.
b62b43
+		   We're not using text/plain, because it would require
b62b43
+		   message-parser to use MESSAGE_PART_FLAG_TEXT for this part
b62b43
+		   to avoid losing line count in message_part serialization. */
b62b43
+		str_append(str, "\"application\" \"octet-stream\"");
b62b43
+		text = FALSE;
b62b43
 	} else {
b62b43
 		/* "content type" "subtype" */
b62b43
 		if (data->content_type == NULL) {
b62b43
@@ -214,17 +225,6 @@ static void part_write_body(const struct message_part *part,
b62b43
 
b62b43
 		part_write_bodystructure_siblings(part->children, str, extended);
b62b43
 		str_printfa(str, " %u", part->body_size.lines);
b62b43
-	} else if (message_rfc822) {
b62b43
-		/* truncated MIME part - write out dummy values */
b62b43
-		i_assert(part->children == NULL);
b62b43
-
b62b43
-		str_append(str, " (NIL NIL NIL NIL NIL NIL NIL NIL NIL NIL) ");
b62b43
-
b62b43
-		if (!extended)
b62b43
-			str_append(str, EMPTY_BODY);
b62b43
-		else
b62b43
-			str_append(str, EMPTY_BODYSTRUCTURE);
b62b43
-		str_printfa(str, " %u", part->body_size.lines);
b62b43
 	}
b62b43
 
b62b43
 	if (!extended)
b62b43
diff --git a/src/lib-imap/test-imap-bodystructure.c b/src/lib-imap/test-imap-bodystructure.c
b62b43
index dfc9957488..6cb699e126 100644
b62b43
--- a/src/lib-imap/test-imap-bodystructure.c
b62b43
+++ b/src/lib-imap/test-imap-bodystructure.c
b62b43
@@ -4,6 +4,7 @@
b62b43
 #include "istream.h"
b62b43
 #include "str.h"
b62b43
 #include "message-part-data.h"
b62b43
+#include "message-part-serialize.h"
b62b43
 #include "message-parser.h"
b62b43
 #include "imap-bodystructure.h"
b62b43
 #include "test-common.h"
b62b43
@@ -379,12 +380,14 @@ struct normalize_test normalize_tests[] = {
b62b43
 static const unsigned int normalize_tests_count = N_ELEMENTS(normalize_tests);
b62b43
 
b62b43
 static struct message_part *
b62b43
-msg_parse(pool_t pool, const char *message, bool parse_bodystructure)
b62b43
+msg_parse(pool_t pool, const char *message, unsigned int max_nested_mime_parts,
b62b43
+	  bool parse_bodystructure)
b62b43
 {
b62b43
 	const struct message_parser_settings parser_set = {
b62b43
 		.hdr_flags = MESSAGE_HEADER_PARSER_FLAG_SKIP_INITIAL_LWSP |
b62b43
 			MESSAGE_HEADER_PARSER_FLAG_DROP_CR,
b62b43
 		.flags = MESSAGE_PARSER_FLAG_SKIP_BODY_BLOCK,
b62b43
+		.max_nested_mime_parts = max_nested_mime_parts,
b62b43
 	};
b62b43
 	struct message_parser_ctx *parser;
b62b43
 	struct istream *input;
b62b43
@@ -418,7 +421,7 @@ static void test_imap_bodystructure_write(void)
b62b43
 		pool_t pool = pool_alloconly_create("imap bodystructure write", 1024);
b62b43
 
b62b43
 		test_begin(t_strdup_printf("imap bodystructure write [%u]", i));
b62b43
-		parts = msg_parse(pool, test->message, TRUE);
b62b43
+		parts = msg_parse(pool, test->message, 0, TRUE);
b62b43
 
b62b43
 		imap_bodystructure_write(parts, str, TRUE);
b62b43
 		test_assert(strcmp(str_c(str), test->bodystructure) == 0);
b62b43
@@ -445,7 +448,7 @@ static void test_imap_bodystructure_parse(void)
b62b43
 		pool_t pool = pool_alloconly_create("imap bodystructure parse", 1024);
b62b43
 
b62b43
 		test_begin(t_strdup_printf("imap bodystructure parser [%u]", i));
b62b43
-		parts = msg_parse(pool, test->message, FALSE);
b62b43
+		parts = msg_parse(pool, test->message, 0, FALSE);
b62b43
 
b62b43
 		test_assert(imap_body_parse_from_bodystructure(test->bodystructure,
b62b43
 								     str, &error) == 0);
b62b43
@@ -512,7 +515,7 @@ static void test_imap_bodystructure_normalize(void)
b62b43
 		pool_t pool = pool_alloconly_create("imap bodystructure parse", 1024);
b62b43
 
b62b43
 		test_begin(t_strdup_printf("imap bodystructure normalize [%u]", i));
b62b43
-		parts = msg_parse(pool, test->message, FALSE);
b62b43
+		parts = msg_parse(pool, test->message, 0, FALSE);
b62b43
 
b62b43
 		ret = imap_bodystructure_parse(test->input,
b62b43
 							   pool, parts, &error);
b62b43
@@ -531,6 +534,67 @@ static void test_imap_bodystructure_normalize(void)
b62b43
 	} T_END;
b62b43
 }
b62b43
 
b62b43
+static const struct {
b62b43
+	const char *input;
b62b43
+	const char *bodystructure;
b62b43
+	unsigned int max_depth;
b62b43
+} truncation_tests[] = {
b62b43
+	{
b62b43
+		.input = "Content-Type: message/rfc822\n"
b62b43
+			"\n"
b62b43
+			"Content-Type: message/rfc822\n"
b62b43
+			"Header2: value2\n"
b62b43
+			"\n"
b62b43
+			"Subject: hello world\n"
b62b43
+			"Header2: value2\n"
b62b43
+			"Header3: value3\n"
b62b43
+			"\n"
b62b43
+			"body line 1\n"
b62b43
+			"body line 2\n"
b62b43
+			"body line 4\n"
b62b43
+			"body line 3\n",
b62b43
+		.bodystructure = "\"message\" \"rfc822\" NIL NIL NIL \"7bit\" 159 (NIL NIL NIL NIL NIL NIL NIL NIL NIL NIL) (\"application\" \"octet-stream\" NIL NIL NIL \"7bit\" 110 NIL NIL NIL NIL) 11 NIL NIL NIL NIL",
b62b43
+		.max_depth = 2,
b62b43
+	},
b62b43
+};
b62b43
+
b62b43
+static void test_imap_bodystructure_truncation(void)
b62b43
+{
b62b43
+	struct message_part *parts;
b62b43
+	const char *error;
b62b43
+	string_t *str_body = t_str_new(128);
b62b43
+	string_t *str_parts = t_str_new(128);
b62b43
+	pool_t pool = pool_alloconly_create("imap bodystructure parse", 1024);
b62b43
+
b62b43
+	test_begin("imap bodystructure truncation");
b62b43
+
b62b43
+	for (unsigned int i = 0; i < N_ELEMENTS(truncation_tests); i++) {
b62b43
+		p_clear(pool);
b62b43
+		str_truncate(str_body, 0);
b62b43
+		str_truncate(str_parts, 0);
b62b43
+
b62b43
+		parts = msg_parse(pool, truncation_tests[i].input,
b62b43
+				  truncation_tests[i].max_depth,
b62b43
+				  TRUE);
b62b43
+
b62b43
+		/* write out BODYSTRUCTURE and serialize message_parts */
b62b43
+		imap_bodystructure_write(parts, str_body, TRUE);
b62b43
+		message_part_serialize(parts, str_parts);
b62b43
+
b62b43
+		/* now deserialize message_parts and make sure they can be used
b62b43
+		   to parse BODYSTRUCTURE */
b62b43
+		parts = message_part_deserialize(pool, str_data(str_parts),
b62b43
+						 str_len(str_parts), &error);
b62b43
+		test_assert(parts != NULL);
b62b43
+		test_assert(imap_bodystructure_parse(str_c(str_body), pool,
b62b43
+						     parts, &error) == 0);
b62b43
+		test_assert_strcmp(str_c(str_body),
b62b43
+				   truncation_tests[i].bodystructure);
b62b43
+	}
b62b43
+	pool_unref(&pool);
b62b43
+	test_end();
b62b43
+}
b62b43
+
b62b43
 int main(void)
b62b43
 {
b62b43
 	static void (*const test_functions[])(void) = {
b62b43
@@ -538,6 +602,7 @@ int main(void)
b62b43
 		test_imap_bodystructure_parse,
b62b43
 		test_imap_bodystructure_normalize,
b62b43
 		test_imap_bodystructure_parse_full,
b62b43
+		test_imap_bodystructure_truncation,
b62b43
 		NULL
b62b43
 	};
b62b43
 	return test_run(test_functions);