From: Aki Tuomi <aki.tuomi@open-xchange.com>
Date: Mon, 10 Nov 2025 07:39:04 +0000 (+0200)
Subject: lib-var-expand: Fix list manipulation in make_new_program()
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fcedf9dfe8db1fa0952df47ddfc26d930188863a;p=thirdparty%2Fdovecot%2Fcore.git

lib-var-expand: Fix list manipulation in make_new_program()

Fixes signal 11 crash when handling multiple chained programs like
hello%{}world.
---

diff --git a/src/lib-var-expand/test-var-expand.c b/src/lib-var-expand/test-var-expand.c
index 2e7ba232a7..750ed65c49 100644
--- a/src/lib-var-expand/test-var-expand.c
+++ b/src/lib-var-expand/test-var-expand.c
@@ -95,6 +95,15 @@ static void test_var_expand_builtin_filters(void) {
 	};
 
 	const struct var_expand_test tests[] = {
+		/* syntax */
+		{ .in = "%{}", .out = "", .ret = 0 },
+		{
+			.in = "%{",
+			.out = "syntax error, unexpected end of file, expecting "
+			       "CCBRACE or PIPE or NAME",
+			.ret = -1
+		},
+		{ .in = "hello%{}world", .out = "helloworld", .ret = 0 },
 		/* basic lookup */
 		{ .in = "%{first}", .out = "hello", .ret = 0 },
 		{ .in = "%{lookup('first')}", .out = "hello", .ret = 0 },
diff --git a/src/lib-var-expand/var-expand-parser.y b/src/lib-var-expand/var-expand-parser.y
index 9c52b3324a..b9a03bbe21 100644
--- a/src/lib-var-expand/var-expand-parser.y
+++ b/src/lib-var-expand/var-expand-parser.y
@@ -174,10 +174,19 @@ push_argument(VAR_EXPAND_PARSER_STYPE *state,
 
 static void make_new_program(VAR_EXPAND_PARSER_STYPE *pstate)
 {
-	struct var_expand_program *p =
+	struct var_expand_program *plast, *pp, *p =
 		p_new(pstate->plist->pool, struct var_expand_program, 1);
 	p->pool = pstate->plist->pool;
-	pstate->pp->next = p;
+	pp = pstate->plist;
+	plast = NULL;
+	while (pp != NULL) {
+		plast = pp;
+		pp = pp->next;
+	}
+	if (plast != NULL)
+		plast->next = p;
+	else
+		pstate->plist = p;
 	pstate->p = p;
 }