From: Timo Sirainen <timo.sirainen@dovecot.fi>
Date: Tue, 12 Jun 2018 17:49:59 +0000 (+0300)
Subject: lib-smtp: Allocate ORCPT addr_type from given memory pool, not data stack
X-Git-Tag: 2.3.9~1701
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a8e5e5a65ace6136f70e88298622736b065619fb;p=thirdparty%2Fdovecot%2Fcore.git

lib-smtp: Allocate ORCPT addr_type from given memory pool, not data stack

This could have caused crashes when parsing ORCPT.
---

diff --git a/src/lib-smtp/smtp-params.c b/src/lib-smtp/smtp-params.c
index ac8aa66ef3..de79ef0b29 100644
--- a/src/lib-smtp/smtp-params.c
+++ b/src/lib-smtp/smtp-params.c
@@ -725,6 +725,7 @@ smtp_params_rcpt_parse_orcpt(struct smtp_params_rcpt_parser *prparser,
 	struct smtp_parser parser;
 	const unsigned char *p, *pend;
 	string_t *address;
+	const char *addr_type;
 	int ret;
 
 	/* ORCPT=<address>: RFC 3461
@@ -751,12 +752,13 @@ smtp_params_rcpt_parse_orcpt(struct smtp_params_rcpt_parser *prparser,
 
 	/* check addr-type */
 	smtp_parser_init(&parser, pool_datastack_create(), value);
-	if (smtp_parser_parse_atom(&parser, &params->orcpt.addr_type) <= 0 ||
+	if (smtp_parser_parse_atom(&parser, &addr_type) <= 0 ||
 		parser.cur >= parser.end || *parser.cur != ';') {
 		prparser->error = "Invalid addr-type for ORCPT= parameter";
 		prparser->error_code = SMTP_PARAM_PARSE_ERROR_BAD_SYNTAX;
 		return -1;
 	}
+	params->orcpt.addr_type = p_strdup(prparser->pool, addr_type);
 	parser.cur++;
 
 	/* check xtext */