auth: Invalid userdb passwd-file and userdb templates may have caused crashes.

Using just "key" parameter instead of "key=value" usually worked, but for
some keys the code assumed that there was a value and it dereferenced NULL.
We'll solve this by just using value="" instead of value=NULL.
Found by Coverity

diff --git a/src/auth/auth-request.c b/src/auth/auth-request.c
index bfa26600baaef427fc10a5b2beba1d62f5334f28..1594333272fd40a36fce1701c9da3e55e79211d7 100644 (file)
--- a/src/auth/auth-request.c
+++ b/src/auth/auth-request.c
@@ -1567,6 +1567,8 @@ void auth_request_set_userdb_field(struct auth_request *request,
        uid_t uid;
        gid_t gid;
 
+       i_assert(value != NULL);
+
        if (strcmp(name, "uid") == 0) {
                uid = userdb_parse_uid(request, value);
                if (uid == (uid_t)-1) {

diff --git a/src/auth/userdb-passwd-file.c b/src/auth/userdb-passwd-file.c
index e6a53cf6fbd5a67b97209b0b95ee1bce8f84af9a..1c4f2a49397fbdb01cf58ada8b3f14bbb8fe4300 100644 (file)
--- a/src/auth/userdb-passwd-file.c
+++ b/src/auth/userdb-passwd-file.c
@@ -76,6 +76,8 @@ static void passwd_file_lookup(struct auth_request *auth_request,
                                str_truncate(str, 0);
                                var_expand(str, value + 1, table);
                                value = str_c(str);
+                       } else {
+                               value = "";
                        }
                        auth_request_set_userdb_field(auth_request, key, value);
                }

diff --git a/src/auth/userdb-template.c b/src/auth/userdb-template.c
index f2591a6d28b326ff9ba2d6410512695f18ea21fc..7a11be9b2f2af218c5393ad724364ca26a647a04 100644 (file)
--- a/src/auth/userdb-template.c
+++ b/src/auth/userdb-template.c
@@ -74,7 +74,7 @@ void userdb_template_export(struct userdb_template *tmpl,
        i_assert((count % 2) == 0);
        for (i = 0; i < count; i += 2) {
                if (args[i+1] == NULL)
-                       value = NULL;
+                       value = "";
                else {
                        str_truncate(str, 0);
                        var_expand(str, args[i+1], table);