From: Timo Sirainen <tss@iki.fi>
Date: Thu, 12 Jun 2014 21:30:27 +0000 (+0300)
Subject: auth: Invalid userdb passwd-file and userdb templates may have caused crashes.
X-Git-Tag: 2.2.14.rc1~407
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=48b28b91852a975a495a6fe82f5db5b35333500a;p=thirdparty%2Fdovecot%2Fcore.git

auth: Invalid userdb passwd-file and userdb templates may have caused crashes.
Using just "key" parameter instead of "key=value" usually worked, but for
some keys the code assumed that there was a value and it dereferenced NULL.
We'll solve this by just using value="" instead of value=NULL.
Found by Coverity
---

diff --git a/src/auth/auth-request.c b/src/auth/auth-request.c
index bfa26600ba..1594333272 100644
--- a/src/auth/auth-request.c
+++ b/src/auth/auth-request.c
@@ -1567,6 +1567,8 @@ void auth_request_set_userdb_field(struct auth_request *request,
 	uid_t uid;
 	gid_t gid;
 
+	i_assert(value != NULL);
+
 	if (strcmp(name, "uid") == 0) {
 		uid = userdb_parse_uid(request, value);
 		if (uid == (uid_t)-1) {
diff --git a/src/auth/userdb-passwd-file.c b/src/auth/userdb-passwd-file.c
index e6a53cf6fb..1c4f2a4939 100644
--- a/src/auth/userdb-passwd-file.c
+++ b/src/auth/userdb-passwd-file.c
@@ -76,6 +76,8 @@ static void passwd_file_lookup(struct auth_request *auth_request,
 				str_truncate(str, 0);
 				var_expand(str, value + 1, table);
 				value = str_c(str);
+			} else {
+				value = "";
 			}
 			auth_request_set_userdb_field(auth_request, key, value);
 		}
diff --git a/src/auth/userdb-template.c b/src/auth/userdb-template.c
index f2591a6d28..7a11be9b2f 100644
--- a/src/auth/userdb-template.c
+++ b/src/auth/userdb-template.c
@@ -74,7 +74,7 @@ void userdb_template_export(struct userdb_template *tmpl,
 	i_assert((count % 2) == 0);
 	for (i = 0; i < count; i += 2) {
 		if (args[i+1] == NULL)
-			value = NULL;
+			value = "";
 		else {
 			str_truncate(str, 0);
 			var_expand(str, args[i+1], table);