lib-smtp: command parser: Fix error recovery.

Input characters were not skipped upon error, meaning that error recovery would encounter these again.
This would make the parser parse the same data over and over again, yielding the same error.
This in turn caused the SMTP server application to hang in an infinite input loop, submitting error replies in the process, thereby filling up the process memory until exhaustion.
Problem seen in submission service, but LMTP is also affected.

diff --git a/src/lib-smtp/smtp-command-parser.c b/src/lib-smtp/smtp-command-parser.c
index f42c681302f0ef32d8967f15188673609aa0fbba..7b1c26d04b4d8b8303dbb7d6e7a13db0bed0c98f 100644 (file)
--- a/src/lib-smtp/smtp-command-parser.c
+++ b/src/lib-smtp/smtp-command-parser.c
@@ -340,12 +340,10 @@ static int smtp_command_parse(struct smtp_command_parser *parser)
                parser->cur = begin;
                parser->end = parser->cur + size;
 
-               if ((ret = smtp_command_parse_line(parser)) < 0)
-                       return -1;
-
+               ret = smtp_command_parse_line(parser);
                i_stream_skip(parser->input, parser->cur - begin);
-               if (ret > 0)
-                       return 1;
+               if (ret != 0)
+                       return ret;
                old_bytes = i_stream_get_data_size(parser->input);
        }