From ba275209e40edb89f310204a99d610e31bf67f6b Mon Sep 17 00:00:00 2001
From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Tue, 10 Apr 2018 02:41:44 +0200
Subject: [PATCH] lib-mail: message-address: Fix address parser to properly
 reject angle-addr without `>'.

---
 src/lib-mail/message-address.c      | 18 ++++++++----------
 src/lib-mail/test-message-address.c |  4 ++++
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/src/lib-mail/message-address.c b/src/lib-mail/message-address.c
index f7cc27f48e..cdb0ee54af 100644
--- a/src/lib-mail/message-address.c
+++ b/src/lib-mail/message-address.c
@@ -141,14 +141,12 @@ static int parse_domain_list(struct message_address_parser_context *ctx)
 
 static int parse_angle_addr(struct message_address_parser_context *ctx)
 {
-	int ret;
-
 	/* "<" [ "@" route ":" ] local-part "@" domain ">" */
 	i_assert(*ctx->parser.data == '<');
 	ctx->parser.data++;
 
-	if ((ret = rfc822_skip_lwsp(&ctx->parser)) <= 0)
-		return ret;
+	if (rfc822_skip_lwsp(&ctx->parser) <= 0)
+		return -1;
 
 	if (*ctx->parser.data == '@') {
 		if (parse_domain_list(ctx) <= 0 || *ctx->parser.data != ':') {
@@ -160,18 +158,18 @@ static int parse_angle_addr(struct message_address_parser_context *ctx)
 		} else {
 			ctx->parser.data++;
 		}
-		if ((ret = rfc822_skip_lwsp(&ctx->parser)) <= 0)
-			return ret;
+		if (rfc822_skip_lwsp(&ctx->parser) <= 0)
+			return -1;
 	}
 
 	if (*ctx->parser.data == '>') {
 		/* <> address isn't valid */
 	} else {
-		if ((ret = parse_local_part(ctx)) <= 0)
-			return ret;
+		if (parse_local_part(ctx) <= 0)
+			return -1;
 		if (*ctx->parser.data == '@') {
-			if ((ret = parse_domain(ctx)) <= 0)
-				return ret;
+			if (parse_domain(ctx) <= 0)
+				return -1;
 		}
 	}
 
diff --git a/src/lib-mail/test-message-address.c b/src/lib-mail/test-message-address.c
index 21084deec9..a37ae7303e 100644
--- a/src/lib-mail/test-message-address.c
+++ b/src/lib-mail/test-message-address.c
@@ -398,10 +398,14 @@ static void test_message_address_path(void)
 static void test_message_address_path_invalid(void)
 {
 	static const char *tests[] = {
+		"<",
+		" < ",
 		">",
 		" > ",
 		"user@domain",
 		"  user@domain  ",
+		"<user@domain",
+		"  <user@domain  ",
 		"user@domain>",
 		"  user@domain>  ",
 		"<user>",
-- 
2.47.3