auth: Fix assert-crash if auth client sends 0 as ID

This could be triggered by anyone having (local) write access to the auth
socket.

diff --git a/src/auth/auth-request-handler.c b/src/auth/auth-request-handler.c
index 8b2f35f983749d9665469551e7a96bd0791201a9..9875ba69e085e6cff18fdc98bd29f90314aa944d 100644 (file)
--- a/src/auth/auth-request-handler.c
+++ b/src/auth/auth-request-handler.c
@@ -490,7 +490,7 @@ bool auth_request_handler_auth_begin(struct auth_request_handler *handler,
        /* <id> <mechanism> [...] */
        list = t_strsplit_tabescaped(args);
        if (list[0] == NULL || list[1] == NULL ||
-           str_to_uint(list[0], &id) < 0) {
+           str_to_uint(list[0], &id) < 0 || id == 0) {
                i_error("BUG: Authentication client %u "
                        "sent broken AUTH request", handler->client_pid);
                return FALSE;