# HG changeset patch
# User Stephan Bosch <stephan.bosch@dovecot.fi>
# Date 1505255318 -7200
# Node ID 2b48af58cbfe451b2cedee25725bd9e856df2db7
# Parent  f08143f2f247a0729166745eb4f8968ef5b42653
lib-smtp: lmtp-client: Fixed handling of unexpected reply while sending RCPT TO commands.

It caused a segfault.

diff -r f08143f2f247 -r 2b48af58cbfe src/lib-smtp/lmtp-client.c
--- a/src/lib-smtp/lmtp-client.c	Fri Sep 08 16:00:53 2017 +0300
+++ b/src/lib-smtp/lmtp-client.c	Wed Sep 13 00:28:38 2017 +0200
@@ -250,7 +250,7 @@
 	lmtp_client_fail_full(client, line, FALSE);
 }
 
-static void
+static int
 lmtp_client_rcpt_next(struct lmtp_client *client, const char *line)
 {
 	struct lmtp_rcpt *rcpt;
@@ -261,12 +261,20 @@
 	if (result == LMTP_CLIENT_RESULT_OK)
 		client->rcpt_to_successes = TRUE;
 
+	if (client->rcpt_next_receive_idx >=
+		array_count(&client->recipients)) {
+		lmtp_client_fail(client, t_strdup_printf(
+			"451 4.5.0 Received unexpected reply: %s", line));
+		return -1;
+	}
+
 	rcpt = array_idx_modifiable(&client->recipients,
 				    client->rcpt_next_receive_idx);
 	client->rcpt_next_receive_idx++;
 
 	rcpt->failed = result != LMTP_CLIENT_RESULT_OK;
 	rcpt->rcpt_to_callback(result, line, rcpt->context);
+	return 0;
 }
 
 static int lmtp_client_send_data_cmd(struct lmtp_client *client)
@@ -556,7 +564,8 @@
 		lmtp_client_send_rcpts(client);
 		break;
 	case LMTP_INPUT_STATE_RCPT_TO:
-		lmtp_client_rcpt_next(client, line);
+		if (lmtp_client_rcpt_next(client, line) < 0)
+			return -1;
 		if (client->data_input == NULL)
 			break;
 		if (lmtp_client_send_data_cmd(client) < 0)