From: Timo Sirainen <tss@iki.fi>
Date: Fri, 22 May 2015 23:07:56 +0000 (-0400)
Subject: auth: Don't crash if trying to add password with TAB or LF to auth cache.
X-Git-Tag: 2.2.19.rc1~455
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e9b69732e4c5126aa840e4bd4e9523aa0b6c7dea;p=thirdparty%2Fdovecot%2Fcore.git

auth: Don't crash if trying to add password with TAB or LF to auth cache.
This would happen only if the passwords were stored as plaintext in passdb
and the valid password actually contained TAB or LF.
---

diff --git a/src/auth/auth-request.c b/src/auth/auth-request.c
index 1406f5f8aa..36f9437f76 100644
--- a/src/auth/auth-request.c
+++ b/src/auth/auth-request.c
@@ -457,11 +457,7 @@ static void auth_request_save_cache(struct auth_request *request,
 			str_append(str, passdb->default_pass_scheme);
 			str_append_c(str, '}');
 		}
-		if (strchr(request->passdb_password, '\t') != NULL)
-			i_panic("%s: Password contains TAB", request->user);
-		if (strchr(request->passdb_password, '\n') != NULL)
-			i_panic("%s: Password contains LF", request->user);
-		str_append(str, request->passdb_password);
+		str_append_tabescaped(str, request->passdb_password);
 	}
 
 	if (!auth_fields_is_empty(request->extra_fields)) {