Blame SOURCES/dovecot-2.3.13-CVE_2020_25275regr-part2.patch

27f02a
From ec2c5ffde7a1ca63219d47831725599e7de76f7f Mon Sep 17 00:00:00 2001
27f02a
From: Timo Sirainen <timo.sirainen@open-xchange.com>
27f02a
Date: Wed, 18 Nov 2020 20:48:11 +0200
27f02a
Subject: [PATCH] lib-imap: Fix writing BODYSTRUCTURE for truncated multipart/
27f02a
 part
27f02a
27f02a
If the max nesting limit is reached, write the last part out as
27f02a
application/octet-stream. The original content-type could be confusing
27f02a
IMAP clients when they don't see any child parts.
27f02a
---
27f02a
 src/lib-imap/imap-bodystructure.c      |  6 ++++++
27f02a
 src/lib-imap/test-imap-bodystructure.c | 15 +++++++++++++++
27f02a
 2 files changed, 21 insertions(+)
27f02a
27f02a
diff --git a/src/lib-imap/imap-bodystructure.c b/src/lib-imap/imap-bodystructure.c
27f02a
index ab422c00d2..bfb6e64197 100644
27f02a
--- a/src/lib-imap/imap-bodystructure.c
27f02a
+++ b/src/lib-imap/imap-bodystructure.c
27f02a
@@ -147,6 +147,7 @@ static bool part_is_truncated(const struct message_part *part)
27f02a
 	const struct message_part_data *data = part->data;
27f02a
 
27f02a
 	i_assert((part->flags & MESSAGE_PART_FLAG_MESSAGE_RFC822) == 0);
27f02a
+	i_assert((part->flags & MESSAGE_PART_FLAG_MULTIPART) == 0);
27f02a
 
27f02a
 	if (data->content_type != NULL) {
27f02a
 		if (strcasecmp(data->content_type, "message") == 0 &&
27f02a
@@ -155,6 +156,11 @@ static bool part_is_truncated(const struct message_part *part)
27f02a
 			   MESSAGE_PART_FLAG_MESSAGE_RFC822. */
27f02a
 			return TRUE;
27f02a
 		}
27f02a
+		if (strcasecmp(data->content_type, "multipart") == 0) {
27f02a
+			/* It's multipart/, but without
27f02a
+			   MESSAGE_PART_FLAG_MULTIPART. */
27f02a
+			return TRUE;
27f02a
+		}
27f02a
 	}
27f02a
 	return FALSE;
27f02a
 }
27f02a
diff --git a/src/lib-imap/test-imap-bodystructure.c b/src/lib-imap/test-imap-bodystructure.c
27f02a
index 6cb699e126..2118907e78 100644
27f02a
--- a/src/lib-imap/test-imap-bodystructure.c
27f02a
+++ b/src/lib-imap/test-imap-bodystructure.c
27f02a
@@ -556,6 +556,21 @@ static const struct {
27f02a
 		.bodystructure = "\"message\" \"rfc822\" NIL NIL NIL \"7bit\" 159 (NIL NIL NIL NIL NIL NIL NIL NIL NIL NIL) (\"application\" \"octet-stream\" NIL NIL NIL \"7bit\" 110 NIL NIL NIL NIL) 11 NIL NIL NIL NIL",
27f02a
 		.max_depth = 2,
27f02a
 	},
27f02a
+	{
27f02a
+		.input = "Content-Type: multipart/mixed; boundary=1\n"
27f02a
+			"\n"
27f02a
+			"--1\n"
27f02a
+			"Content-Type: multipart/mixed; boundary=2\n"
27f02a
+			"\n"
27f02a
+			"--2\n"
27f02a
+			"Content-Type: multipart/mixed; boundary=3\n"
27f02a
+			"\n"
27f02a
+			"--3\n"
27f02a
+			"\n"
27f02a
+			"body\n",
27f02a
+		.bodystructure = "(\"application\" \"octet-stream\" (\"boundary\" \"2\") NIL NIL \"7bit\" 63 NIL NIL NIL NIL) \"mixed\" (\"boundary\" \"1\") NIL NIL NIL",
27f02a
+		.max_depth = 2,
27f02a
+	},
27f02a
 };
27f02a
 
27f02a
 static void test_imap_bodystructure_truncation(void)