if (name_len > 8 && strcmp(name+name_len-8, ":default") == 0) {
/* set this field only if it hasn't been set before */
name = t_strndup(name, name_len-8);
+ if (name[0] == '\0')
+ return; /* ":default" is invalid */
if (auth_fields_exists(request->fields.extra_fields, name))
return;
} else if (name_len > 7 && strcmp(name+name_len-7, ":remove") == 0) {
name = t_strndup(name, name_len-8);
if (auth_fields_exists(request->fields.userdb_reply, name))
return;
+ if (name[0] == '\0')
+ return; /* ":default" is invalid */
} else if (name_len > 7 && strcmp(name+name_len-7, ":remove") == 0) {
/* remove this field entirely */
name = t_strndup(name, name_len-7);