From: Stephan Bosch <stephan.bosch@open-xchange.com>
Date: Thu, 19 Jun 2025 23:48:48 +0000 (+0200)
Subject: lib-smtp: smtp-client-command - Generate multiple callbacks when required in smtp_cli... 
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b012cfb3b17e14b79b0a5d13624d554f9a6b5254;p=thirdparty%2Fdovecot%2Fcore.git

lib-smtp: smtp-client-command - Generate multiple callbacks when required in smtp_client_command_fail*()

This requirement applies to the LTMP DATA command when more than a single
recipient is approved.

This caused a crash in the LMTP service occurring when the proxy client
connection was lost during the DATA command while more than a single RCPT
command was expected earlier. This situation caused an early free/dangling
pointer for the DATA command struct, subsequently causing a crash at
deinitialization of the proxy.
---

diff --git a/src/lib-smtp/smtp-client-command.c b/src/lib-smtp/smtp-client-command.c
index 5b763a7a10..66d5bb5c24 100644
--- a/src/lib-smtp/smtp-client-command.c
+++ b/src/lib-smtp/smtp-client-command.c
@@ -341,8 +341,10 @@ void smtp_client_command_fail_reply(struct smtp_client_command **_cmd,
 		}
 		e_debug(e->event(), "Failed: %s", smtp_reply_log(reply));
 
-		if (callback != NULL)
-			(void)callback(reply, context);
+		if (callback != NULL) {
+			while (cmd->replies_seen++ < cmd->replies_expected)
+				(void)callback(reply, context);
+		}
 	}
 
 	tmp_cmd = cmd;