From: Stephan Bosch <stephan.bosch@open-xchange.com>
Date: Fri, 20 Mar 2020 12:38:41 +0000 (+0100)
Subject: lmtp: lmtp-commands - Explicity prohibit empty RCPT path.
X-Git-Tag: 2.3.11.2~73
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f0ea88118f21c79afcb85b3ff68eb84304c569ba;p=thirdparty%2Fdovecot%2Fcore.git

lmtp: lmtp-commands - Explicity prohibit empty RCPT path.

The empty path <""> will yield an empty username.
---

diff --git a/src/lmtp/lmtp-commands.c b/src/lmtp/lmtp-commands.c
index 2c0d57f2cb..2988c88730 100644
--- a/src/lmtp/lmtp-commands.c
+++ b/src/lmtp/lmtp-commands.c
@@ -66,10 +66,18 @@ int client_default_cmd_rcpt(struct client *client,
 	char delim = '\0';
 	int ret;
 
+	i_assert(!smtp_address_isnull(rcpt->path));
+	if (*rcpt->path->localpart == '\0' && rcpt->path->domain == NULL) {
+		smtp_server_recipient_reply(
+			rcpt, 550, "5.1.1",
+			"Unacceptable TO: Empty path not allowed");
+		return -1;
+	}
 
 	smtp_address_detail_parse_temp(
 		client->unexpanded_lda_set->recipient_delimiter,
 		rcpt->path, &username, &delim, &detail);
+	i_assert(*username != '\0');
 
 	/* Make user name and detail available in the recipient event. The
 	   mail_user event (for local delivery) also adds the user field, but