From: Timo Sirainen <timo.sirainen@dovecot.fi>
Date: Sat, 21 Apr 2018 10:05:49 +0000 (+0300)
Subject: lib-mail: rfc822-parser: Don't allow preserving escaped [CR]LF
X-Git-Tag: 2.3.4~259
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c98c10e35d59f6b61707ab16e8ec9391e9c8026b;p=thirdparty%2Fdovecot%2Fcore.git

lib-mail: rfc822-parser: Don't allow preserving escaped [CR]LF

It's not valid to have "\<CR>" or "\<LF>", so the old behavior isn't really
wrong either. However, rfc822_parse_quoted_string() callers are more likely
to expect that the output won't contain any [CR]LF so this new behavior is
a bit better.
---

diff --git a/src/lib-mail/rfc822-parser.c b/src/lib-mail/rfc822-parser.c
index 917288cda7..2f7e77da9c 100644
--- a/src/lib-mail/rfc822-parser.c
+++ b/src/lib-mail/rfc822-parser.c
@@ -234,6 +234,13 @@ int rfc822_parse_quoted_string(struct rfc822_parser_context *ctx, string_t *str)
 			if (ctx->data >= ctx->end)
 				return -1;
 
+			if (*ctx->data == '\r' || *ctx->data == '\n') {
+				/* quoted-pair doesn't allow CR/LF.
+				   They are part of the obs-qp though, so don't
+				   return them as error. */
+				ctx->data--;
+				break;
+			}
 			str_append_data(str, start, ctx->data - start - 1);
 			start = ctx->data;
 			break;
diff --git a/src/lib-mail/test-rfc822-parser.c b/src/lib-mail/test-rfc822-parser.c
index 695021f1e5..8f8d4fb66b 100644
--- a/src/lib-mail/test-rfc822-parser.c
+++ b/src/lib-mail/test-rfc822-parser.c
@@ -18,7 +18,11 @@ static void test_rfc822_parse_quoted_string(void)
 		{ "\"\"\"", "", 1 },
 		{ "\"\\\"\"", "\"", 0 },
 		{ "\"\\\\\"", "\\", 0 },
-		{ "\"\\\\foo\\\\foo\\\\\"", "\\foo\\foo\\", 0 }
+		{ "\"\\\\foo\\\\foo\\\\\"", "\\foo\\foo\\", 0 },
+		{ "\"foo\n bar\"", "foo bar", 0 },
+		{ "\"foo\n\t\t bar\"", "foo\t\t bar", 0 },
+		{ "\"foo\\\n bar\"", "foo\\ bar", 0 },
+		{ "\"foo\\\r\n bar\"", "foo\\ bar", 0 },
 	};
 	struct rfc822_parser_context parser;
 	string_t *str = t_str_new(64);