File 0001-lib-managesieve-Don-t-accept-strings-with-... of Package dovecot22

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch of Package dovecot22

From 3280e97580bd095aff7b43a3ae0d3baa5585af7a Mon Sep 17 00:00:00 2001
From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Fri, 10 May 2019 19:43:55 +0300
Subject: [PATCH 1/2] lib-managesieve: Don't accept strings with NULs

ManageSieve doesn't allow NULs in strings.

This fixes a bug with unescaping a string with NULs: str_unescape() could
have been called for memory that points outside the allocated string,
causing heap corruption. This could cause crashes or theoretically even
result in remote code execution exploit.

Found by Nick Roessler and Rafi Rubin
---
 src/lib-managesieve/managesieve-parser.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git dovecot-2.2-pigeonhole-0.4.19/src/lib-managesieve/managesieve-parser.c b/src/lib-managesieve/managesieve-parser.c
index d3eb2101..c8f19ef6 100644
--- dovecot-2.2-pigeonhole-0.4.19/src/lib-managesieve/managesieve-parser.c
+++ dovecot-2.2-pigeonhole-0.4.19/src/lib-managesieve/managesieve-parser.c
@@ -258,6 +258,11 @@ managesieve_parser_read_string(struct managesieve_parser *parser,
 			break;
 		}
 
+		if (data[0] == '\0') {
+			parser->error = "NULs not allowed in strings";
+			return FALSE;
+		}
+
 		if (data[i] == '\\') {
 			if (i+1 == data_size) {
 				/* known data ends with '\' - leave it to
-- 
2.11.0

Places

File 0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch of Package dovecot22

Places