added check for slash in list control string

diff --git a/src/listcontrol.c b/src/listcontrol.c
index dc93f387c577f1118b874a5f4c45182c635c1618..86c71bee59c3a259dbec3885fa769e0e5decc439 100644 (file)
--- a/src/listcontrol.c
+++ b/src/listcontrol.c
@@ -105,6 +105,13 @@ int listcontrol(const char *mailfilename, const char *listdir,
                                        (controlstr[cmdlen] == '-')) {
                                param = strdup(controlstr + cmdlen + 1);
                                MY_ASSERT(param);
+                               if (strchr(param, '/')) {
+                                       errno = 0;
+                                       log_error(LOG_ARGS, "Slash (/) in"
+                                               " list control request,"
+                                               " discarding mail");
+                                       exit(EXIT_SUCCESS);
+                               }
                                free(controlstr);
                                break;
                        } else if (!ctrl_commands[ctrl].accepts_parameter &&