From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Mon, 18 Dec 2017 14:20:07 +0000 (+0100)
Subject: lib-smtp: command parser: Fix error recovery.
X-Git-Tag: 2.3.9~2635
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0ac0c93af1bb5c2aabf953bfebbd7df39665e080;p=thirdparty%2Fdovecot%2Fcore.git

lib-smtp: command parser: Fix error recovery.

Input characters were not skipped upon error, meaning that error recovery would encounter these again.
This would make the parser parse the same data over and over again, yielding the same error.
This in turn caused the SMTP server application to hang in an infinite input loop, submitting error replies in the process, thereby filling up the process memory until exhaustion.
Problem seen in submission service, but LMTP is also affected.
---

diff --git a/src/lib-smtp/smtp-command-parser.c b/src/lib-smtp/smtp-command-parser.c
index f42c681302..7b1c26d04b 100644
--- a/src/lib-smtp/smtp-command-parser.c
+++ b/src/lib-smtp/smtp-command-parser.c
@@ -340,12 +340,10 @@ static int smtp_command_parse(struct smtp_command_parser *parser)
 		parser->cur = begin;
 		parser->end = parser->cur + size;
 
-		if ((ret = smtp_command_parse_line(parser)) < 0)
-			return -1;
-
+		ret = smtp_command_parse_line(parser);
 		i_stream_skip(parser->input, parser->cur - begin);
-		if (ret > 0)
-			return 1;
+		if (ret != 0)
+			return ret;
 		old_bytes = i_stream_get_data_size(parser->input);
 	}