Mercurial > dovecot > core-2.2
changeset 22496:2b48af58cbfe
lib-smtp: lmtp-client: Fixed handling of unexpected reply while sending RCPT TO commands.
It caused a segfault.
| author | Stephan Bosch <stephan.bosch@dovecot.fi> |
|---|---|
| date | Wed, 13 Sep 2017 00:28:38 +0200 |
| parents | f08143f2f247 |
| children | c836d071d8a7 |
| files | src/lib-smtp/lmtp-client.c |
| diffstat | 1 files changed, 11 insertions(+), 2 deletions(-) [+] |
line wrap: on
line diff
--- a/src/lib-smtp/lmtp-client.c Fri Sep 08 16:00:53 2017 +0300 +++ b/src/lib-smtp/lmtp-client.c Wed Sep 13 00:28:38 2017 +0200 @@ -250,7 +250,7 @@ lmtp_client_fail_full(client, line, FALSE); } -static void +static int lmtp_client_rcpt_next(struct lmtp_client *client, const char *line) { struct lmtp_rcpt *rcpt; @@ -261,12 +261,20 @@ if (result == LMTP_CLIENT_RESULT_OK) client->rcpt_to_successes = TRUE; + if (client->rcpt_next_receive_idx >= + array_count(&client->recipients)) { + lmtp_client_fail(client, t_strdup_printf( + "451 4.5.0 Received unexpected reply: %s", line)); + return -1; + } + rcpt = array_idx_modifiable(&client->recipients, client->rcpt_next_receive_idx); client->rcpt_next_receive_idx++; rcpt->failed = result != LMTP_CLIENT_RESULT_OK; rcpt->rcpt_to_callback(result, line, rcpt->context); + return 0; } static int lmtp_client_send_data_cmd(struct lmtp_client *client) @@ -556,7 +564,8 @@ lmtp_client_send_rcpts(client); break; case LMTP_INPUT_STATE_RCPT_TO: - lmtp_client_rcpt_next(client, line); + if (lmtp_client_rcpt_next(client, line) < 0) + return -1; if (client->data_input == NULL) break; if (lmtp_client_send_data_cmd(client) < 0)