From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Sun, 4 Mar 2018 22:35:53 +0000 (+0100)
Subject: lib-smtp: server: Fix double decrement of RCPT pending counter upon error.
X-Git-Tag: 2.3.9~2190
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8f3829ce994872c2bc883f59208441fe35fa750b;p=thirdparty%2Fdovecot%2Fcore.git

lib-smtp: server: Fix double decrement of RCPT pending counter upon error.

The pending counter was sometimes decremented twice in specific error
conditions, leading to an assert panic in the DATA command. This was caused by
some dead code. If the MAIL command failed in a pipeline before the RCPT command,
the assert was triggered.

Panic was:

Panic: file smtp-server-cmd-data.c: line 354 (cmd_data_start): assertion failed: (conn->state.pending_mail_cmds == 0 && conn->state.pending_rcpt_cmds == 0)
---

diff --git a/src/lib-smtp/smtp-server-cmd-rcpt.c b/src/lib-smtp/smtp-server-cmd-rcpt.c
index cac03c83c7..2cdcc14535 100644
--- a/src/lib-smtp/smtp-server-cmd-rcpt.c
+++ b/src/lib-smtp/smtp-server-cmd-rcpt.c
@@ -16,14 +16,9 @@ static bool
 cmd_rcpt_check_state(struct smtp_server_cmd_ctx *cmd)
 {
 	struct smtp_server_connection *conn = cmd->conn;
-	struct smtp_server_command *command = cmd->cmd;
 	struct smtp_server_transaction *trans = conn->state.trans;
 
 	if (conn->state.pending_mail_cmds == 0 && trans == NULL) {
-		if (command->hook_replied != NULL) {
-			conn->state.pending_rcpt_cmds--;
-			command->hook_replied = NULL;
-		}
 		smtp_server_reply(cmd,
 			503, "5.5.0", "MAIL needed first");
 		return FALSE;