From a8e5e5a65ace6136f70e88298622736b065619fb Mon Sep 17 00:00:00 2001 From: Timo Sirainen Date: Tue, 12 Jun 2018 20:49:59 +0300 Subject: [PATCH] lib-smtp: Allocate ORCPT addr_type from given memory pool, not data stack This could have caused crashes when parsing ORCPT. --- src/lib-smtp/smtp-params.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/lib-smtp/smtp-params.c b/src/lib-smtp/smtp-params.c index ac8aa66ef3..de79ef0b29 100644 --- a/src/lib-smtp/smtp-params.c +++ b/src/lib-smtp/smtp-params.c @@ -725,6 +725,7 @@ smtp_params_rcpt_parse_orcpt(struct smtp_params_rcpt_parser *prparser, struct smtp_parser parser; const unsigned char *p, *pend; string_t *address; + const char *addr_type; int ret; /* ORCPT=
: RFC 3461 @@ -751,12 +752,13 @@ smtp_params_rcpt_parse_orcpt(struct smtp_params_rcpt_parser *prparser, /* check addr-type */ smtp_parser_init(&parser, pool_datastack_create(), value); - if (smtp_parser_parse_atom(&parser, ¶ms->orcpt.addr_type) <= 0 || + if (smtp_parser_parse_atom(&parser, &addr_type) <= 0 || parser.cur >= parser.end || *parser.cur != ';') { prparser->error = "Invalid addr-type for ORCPT= parameter"; prparser->error_code = SMTP_PARAM_PARSE_ERROR_BAD_SYNTAX; return -1; } + params->orcpt.addr_type = p_strdup(prparser->pool, addr_type); parser.cur++; /* check xtext */ -- 2.47.3