From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Tue, 12 Sep 2017 22:28:38 +0000 (+0200)
Subject: lib-smtp: lmtp-client: Fixed handling of unexpected reply while sending RCPT TO commands.
X-Git-Tag: 2.2.33.rc1~80
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6f967d6c4dc0ad06fa5f8d5f9e4782f1523d11dd;p=thirdparty%2Fdovecot%2Fcore.git

lib-smtp: lmtp-client: Fixed handling of unexpected reply while sending RCPT TO commands.

It caused a segfault.
---

diff --git a/src/lib-smtp/lmtp-client.c b/src/lib-smtp/lmtp-client.c
index 8db9656c39..47571668cc 100644
--- a/src/lib-smtp/lmtp-client.c
+++ b/src/lib-smtp/lmtp-client.c
@@ -250,7 +250,7 @@ void lmtp_client_fail(struct lmtp_client *client, const char *line)
 	lmtp_client_fail_full(client, line, FALSE);
 }
 
-static void
+static int
 lmtp_client_rcpt_next(struct lmtp_client *client, const char *line)
 {
 	struct lmtp_rcpt *rcpt;
@@ -261,12 +261,20 @@ lmtp_client_rcpt_next(struct lmtp_client *client, const char *line)
 	if (result == LMTP_CLIENT_RESULT_OK)
 		client->rcpt_to_successes = TRUE;
 
+	if (client->rcpt_next_receive_idx >=
+		array_count(&client->recipients)) {
+		lmtp_client_fail(client, t_strdup_printf(
+			"451 4.5.0 Received unexpected reply: %s", line));
+		return -1;
+	}
+
 	rcpt = array_idx_modifiable(&client->recipients,
 				    client->rcpt_next_receive_idx);
 	client->rcpt_next_receive_idx++;
 
 	rcpt->failed = result != LMTP_CLIENT_RESULT_OK;
 	rcpt->rcpt_to_callback(result, line, rcpt->context);
+	return 0;
 }
 
 static int lmtp_client_send_data_cmd(struct lmtp_client *client)
@@ -556,7 +564,8 @@ static int lmtp_client_input_line(struct lmtp_client *client, const char *line)
 		lmtp_client_send_rcpts(client);
 		break;
 	case LMTP_INPUT_STATE_RCPT_TO:
-		lmtp_client_rcpt_next(client, line);
+		if (lmtp_client_rcpt_next(client, line) < 0)
+			return -1;
 		if (client->data_input == NULL)
 			break;
 		if (lmtp_client_send_data_cmd(client) < 0)