From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Sun, 26 Aug 2018 13:16:17 +0000 (+0200)
Subject: lib-smtp: client: Fix potential segfault occurring after receiving RCPT reply.
X-Git-Tag: 2.3.9~1506
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fc73625ae73d04915e6e79fd27619d8af8a3fd3c;p=thirdparty%2Fdovecot%2Fcore.git

lib-smtp: client: Fix potential segfault occurring after receiving RCPT reply.

Could occur when RCPT reply is received befor DATA command is sent in LMTP session.

Problem found by Coverity.
---

diff --git a/src/lib-smtp/smtp-client-transaction.c b/src/lib-smtp/smtp-client-transaction.c
index 0d0638a753..1d08d42479 100644
--- a/src/lib-smtp/smtp-client-transaction.c
+++ b/src/lib-smtp/smtp-client-transaction.c
@@ -557,7 +557,8 @@ smtp_client_transaction_rcpt_cb(const struct smtp_reply *reply,
 		if (array_count(&trans->rcpts) == 0) {
 			/* abort transaction if all recipients failed */
 			smtp_client_transaction_abort(trans);
-		} else if (conn->protocol == SMTP_PROTOCOL_LMTP) {
+		} else if (conn->protocol == SMTP_PROTOCOL_LMTP &&
+			   trans->cmd_data != NULL) {
 			smtp_client_command_set_replies(trans->cmd_data,
 				array_count(&trans->rcpts));
 		}