From: Aki Tuomi <aki.tuomi@open-xchange.com>
Date: Tue, 12 May 2020 06:48:06 +0000 (+0300)
Subject: auth: mech-digest-md5 - Do not read past buffer on right trim
X-Git-Tag: 2.3.11.2~93
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a6f12894b327f8beeb14b4ce87a446409a9cd82b;p=thirdparty%2Fdovecot%2Fcore.git

auth: mech-digest-md5 - Do not read past buffer on right trim

If the string does not have comma at the end, do not progress
the pointer past buffer end.
---

diff --git a/src/auth/mech-digest-md5.c b/src/auth/mech-digest-md5.c
index 98057eb410..5f39ea5bb9 100644
--- a/src/auth/mech-digest-md5.c
+++ b/src/auth/mech-digest-md5.c
@@ -226,7 +226,10 @@ static bool parse_next(char **data, char **key, char **value)
 		while (*p != '\0' && *p != ',')
 			p++;
 
-		*data = p+1;
+		*data = p;
+		/* If there is more to parse, ensure it won't get skipped
+		   because *p is set to NUL below */
+		if (**data != '\0') (*data)++;
 		while (IS_LWS(p[-1]))
 			p--;
 		*p = '\0';