Blame SOURCES/dovecot-2.3.13-CVE_2020_25275regr-part3.patch

27f02a
From a912198bdc38421ad84044089db84fc14c69c228 Mon Sep 17 00:00:00 2001
27f02a
From: Timo Sirainen <timo.sirainen@open-xchange.com>
27f02a
Date: Wed, 18 Nov 2020 21:22:45 +0200
27f02a
Subject: [PATCH] lib-imap: Fix writing BODYSTRUCTURE for truncated
27f02a
 multipart/digest part
27f02a
27f02a
Fixes error while parsing BODYSTRUCTURE:
27f02a
message_part message/rfc822 flag doesn't match lines in BODYSTRUCTURE
27f02a
---
27f02a
 src/lib-imap/imap-bodystructure.c      |  9 +++++++++
27f02a
 src/lib-imap/test-imap-bodystructure.c | 28 ++++++++++++++++++++++----
27f02a
 2 files changed, 33 insertions(+), 4 deletions(-)
27f02a
27f02a
diff --git a/src/lib-imap/imap-bodystructure.c b/src/lib-imap/imap-bodystructure.c
27f02a
index bfb6e64197..5d2e5a3a84 100644
27f02a
--- a/src/lib-imap/imap-bodystructure.c
27f02a
+++ b/src/lib-imap/imap-bodystructure.c
27f02a
@@ -161,6 +161,14 @@ static bool part_is_truncated(const struct message_part *part)
27f02a
 			   MESSAGE_PART_FLAG_MULTIPART. */
27f02a
 			return TRUE;
27f02a
 		}
27f02a
+	} else {
27f02a
+		/* No Content-Type */
27f02a
+		if (part->parent != NULL &&
27f02a
+		    (part->parent->flags & MESSAGE_PART_FLAG_MULTIPART_DIGEST) != 0) {
27f02a
+			/* Parent is MESSAGE_PART_FLAG_MULTIPART_DIGEST
27f02a
+			   (so this should have been message/rfc822). */
27f02a
+			return TRUE;
27f02a
+		}
27f02a
 	}
27f02a
 	return FALSE;
27f02a
 }
27f02a
@@ -195,6 +203,7 @@ static void part_write_body(const struct message_part *part,
27f02a
 			str_append_c(str, ' ');
27f02a
 			imap_append_string(str, data->content_subtype);
27f02a
 		}
27f02a
+		i_assert(text == ((part->flags & MESSAGE_PART_FLAG_TEXT) != 0));
27f02a
 	}
27f02a
 
27f02a
 	/* ("content type param key" "value" ...) */
27f02a
diff --git a/src/lib-imap/test-imap-bodystructure.c b/src/lib-imap/test-imap-bodystructure.c
27f02a
index 2118907e78..0f70cb0035 100644
27f02a
--- a/src/lib-imap/test-imap-bodystructure.c
27f02a
+++ b/src/lib-imap/test-imap-bodystructure.c
27f02a
@@ -381,13 +381,14 @@ static const unsigned int normalize_tests_count = N_ELEMENTS(normalize_tests);
27f02a
 
27f02a
 static struct message_part *
27f02a
 msg_parse(pool_t pool, const char *message, unsigned int max_nested_mime_parts,
27f02a
-	  bool parse_bodystructure)
27f02a
+	  unsigned int max_total_mime_parts, bool parse_bodystructure)
27f02a
 {
27f02a
 	const struct message_parser_settings parser_set = {
27f02a
 		.hdr_flags = MESSAGE_HEADER_PARSER_FLAG_SKIP_INITIAL_LWSP |
27f02a
 			MESSAGE_HEADER_PARSER_FLAG_DROP_CR,
27f02a
 		.flags = MESSAGE_PARSER_FLAG_SKIP_BODY_BLOCK,
27f02a
 		.max_nested_mime_parts = max_nested_mime_parts,
27f02a
+		.max_total_mime_parts = max_total_mime_parts,
27f02a
 	};
27f02a
 	struct message_parser_ctx *parser;
27f02a
 	struct istream *input;
27f02a
@@ -421,7 +422,7 @@ static void test_imap_bodystructure_write(void)
27f02a
 		pool_t pool = pool_alloconly_create("imap bodystructure write", 1024);
27f02a
 
27f02a
 		test_begin(t_strdup_printf("imap bodystructure write [%u]", i));
27f02a
-		parts = msg_parse(pool, test->message, 0, TRUE);
27f02a
+		parts = msg_parse(pool, test->message, 0, 0, TRUE);
27f02a
 
27f02a
 		imap_bodystructure_write(parts, str, TRUE);
27f02a
 		test_assert(strcmp(str_c(str), test->bodystructure) == 0);
27f02a
@@ -448,7 +449,7 @@ static void test_imap_bodystructure_parse(void)
27f02a
 		pool_t pool = pool_alloconly_create("imap bodystructure parse", 1024);
27f02a
 
27f02a
 		test_begin(t_strdup_printf("imap bodystructure parser [%u]", i));
27f02a
-		parts = msg_parse(pool, test->message, 0, FALSE);
27f02a
+		parts = msg_parse(pool, test->message, 0, 0, FALSE);
27f02a
 
27f02a
 		test_assert(imap_body_parse_from_bodystructure(test->bodystructure,
27f02a
 								     str, &error) == 0);
27f02a
@@ -515,7 +516,7 @@ static void test_imap_bodystructure_normalize(void)
27f02a
 		pool_t pool = pool_alloconly_create("imap bodystructure parse", 1024);
27f02a
 
27f02a
 		test_begin(t_strdup_printf("imap bodystructure normalize [%u]", i));
27f02a
-		parts = msg_parse(pool, test->message, 0, FALSE);
27f02a
+		parts = msg_parse(pool, test->message, 0, 0, FALSE);
27f02a
 
27f02a
 		ret = imap_bodystructure_parse(test->input,
27f02a
 							   pool, parts, &error);
27f02a
@@ -538,6 +539,7 @@ static const struct {
27f02a
 	const char *input;
27f02a
 	const char *bodystructure;
27f02a
 	unsigned int max_depth;
27f02a
+	unsigned int max_total;
27f02a
 } truncation_tests[] = {
27f02a
 	{
27f02a
 		.input = "Content-Type: message/rfc822\n"
27f02a
@@ -571,6 +573,23 @@ static const struct {
27f02a
 		.bodystructure = "(\"application\" \"octet-stream\" (\"boundary\" \"2\") NIL NIL \"7bit\" 63 NIL NIL NIL NIL) \"mixed\" (\"boundary\" \"1\") NIL NIL NIL",
27f02a
 		.max_depth = 2,
27f02a
 	},
27f02a
+	{
27f02a
+		.input = "Content-Type: multipart/digest; boundary=1\n"
27f02a
+			"\n"
27f02a
+			"--1\n"
27f02a
+			"\n"
27f02a
+			"Subject: hdr1\n"
27f02a
+			"\n"
27f02a
+			"body1\n"
27f02a
+			"--1\n"
27f02a
+			"\n"
27f02a
+			"Subject: hdr2\n"
27f02a
+			"\n"
27f02a
+			"body2\n",
27f02a
+		.bodystructure = "(\"application\" \"octet-stream\" NIL NIL NIL \"7bit\" 55 NIL NIL NIL NIL) \"digest\" (\"boundary\" \"1\") NIL NIL NIL",
27f02a
+		.max_total = 2,
27f02a
+	},
27f02a
+
27f02a
 };
27f02a
 
27f02a
 static void test_imap_bodystructure_truncation(void)
27f02a
@@ -590,6 +609,7 @@ static void test_imap_bodystructure_truncation(void)
27f02a
 
27f02a
 		parts = msg_parse(pool, truncation_tests[i].input,
27f02a
 				  truncation_tests[i].max_depth,
27f02a
+				  truncation_tests[i].max_total,
27f02a
 				  TRUE);
27f02a
 
27f02a
 		/* write out BODYSTRUCTURE and serialize message_parts */