dovecot/CVE-2019-11494-1.patch
daidai_is_here b34e0dbbf6 init package
2020-02-18 10:50:31 +08:00

32 lines
1.5 KiB
Diff

From e9d60648abb9bbceff89882a5309cb9532e702e9 Mon Sep 17 00:00:00 2001
From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Thu, 25 Apr 2019 09:51:32 +0200
Subject: [PATCH 3/3] lib-smtp: smtp-server-cmd-auth - Fix AUTH response error
handling so that it stops reading more input.
Otherwise, it may try to read more data from the stream as the next AUTH
response, which causes an assert crash in the command parser later on. Even when
the parser finds no input from the stream, it will advance its state
towards AUTH response parsing, which is a problem when the next command is
subsequently being parsed.
Panic was:
Panic: file smtp-command-parser.c: line 438 (smtp_command_parse_next): assertion failed: (!parser->auth_response || parser->state.state == SMTP_COMMAND_PARSE_STATE_INIT || parser->state.state == SMTP_COMMAND_PARSE_STATE_ERROR)
---
src/lib-smtp/smtp-server-cmd-auth.c | 1 +
1 file changed, 1 insertion(+)
Index: dovecot-2.3.4.1/src/lib-smtp/smtp-server-cmd-auth.c
===================================================================
--- dovecot-2.3.4.1.orig/src/lib-smtp/smtp-server-cmd-auth.c 2019-04-29 07:39:15.045289307 -0400
+++ dovecot-2.3.4.1/src/lib-smtp/smtp-server-cmd-auth.c 2019-04-29 07:39:15.037289277 -0400
@@ -97,6 +97,7 @@ static void cmd_auth_input(struct smtp_s
smtp_server_connection_debug(conn,
"Client sent invalid AUTH response: %s", error);
+ smtp_server_command_input_lock(cmd);
switch (error_code) {
case SMTP_COMMAND_PARSE_ERROR_BROKEN_COMMAND:
conn->input_broken = TRUE;