From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Wed, 19 Sep 2018 20:26:08 +0000 (+0200)
Subject: lib-smtp: reply-parser: Fix closing the text_lines array with NULL sentinel.
X-Git-Tag: 2.3.9~1388
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d161ee81da8411cac62a1d72dfc2f36f8ada4e17;p=thirdparty%2Fdovecot%2Fcore.git

lib-smtp: reply-parser: Fix closing the text_lines array with NULL sentinel.

For (EHLO) replies with more than 7 lines, the text_lines array of the reply did
not end in NULL, causing a segfault.
---

diff --git a/src/lib-smtp/smtp-reply-parser.c b/src/lib-smtp/smtp-reply-parser.c
index b1bdf5253e..d47eab4513 100644
--- a/src/lib-smtp/smtp-reply-parser.c
+++ b/src/lib-smtp/smtp-reply-parser.c
@@ -582,6 +582,9 @@ int smtp_reply_parse_next(struct smtp_reply_parser *parser,
 		return ret;
 	}
 
+	i_assert(array_count(&parser->state.reply_lines) > 0);
+	array_append_zero(&parser->state.reply_lines);
+
 	parser->state.state = SMTP_REPLY_PARSE_STATE_INIT;
 	parser->state.reply->text_lines =
 		array_idx(&parser->state.reply_lines, 0);
@@ -623,6 +626,9 @@ int smtp_reply_parse_ehlo(struct smtp_reply_parser *parser,
 		return ret;
 	}
 
+	i_assert(array_count(&parser->state.reply_lines) > 0);
+	array_append_zero(&parser->state.reply_lines);
+
 	parser->state.state = SMTP_REPLY_PARSE_STATE_INIT;
 	parser->state.reply->text_lines =
 		array_idx(&parser->state.reply_lines, 0);