From 954c1db0e64e742b29fdd438f8ed5bc86c0a2c3e Mon Sep 17 00:00:00 2001 From: Timo Sirainen Date: Tue, 14 Oct 2025 17:59:36 +0300 Subject: [PATCH] lib-mail: Fix potential crash with SEARCH MIMEPART FILENAME If the message contained "Content-Disposition: attachment" without filename or name parameter, it crashed. Fix by using empty string as the filename so callers don't need to handle NULL separately. Broken by bdff009cb37eb51aa7a00e17e1b346df18f95bec --- src/lib-mail/message-part-data.c | 6 ++++++ src/lib-mail/test-message-part-data.c | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/src/lib-mail/message-part-data.c b/src/lib-mail/message-part-data.c index 07c077953b..62f42c1078 100644 --- a/src/lib-mail/message-part-data.c +++ b/src/lib-mail/message-part-data.c @@ -105,6 +105,12 @@ static bool message_part_data_find_attachment_filename( get_param_value("name", data->content_type_params, data->content_type_params_count, filename_r)) return TRUE; + if (default_return && filename_r != NULL) { + /* This is an attachment without filename or name parameter. + Just return the filename as empty string, so the caller + doesn't have to handle NULL filename separately. */ + *filename_r = ""; + } return default_return; } diff --git a/src/lib-mail/test-message-part-data.c b/src/lib-mail/test-message-part-data.c index 22ab87aff6..2b29cfac04 100644 --- a/src/lib-mail/test-message-part-data.c +++ b/src/lib-mail/test-message-part-data.c @@ -133,7 +133,7 @@ static void test_message_inline_without_filename(void) "\n" "xxxdata\n"; - test_message_part_attachment(test_name, input, FALSE, NULL); + test_message_part_attachment(test_name, input, FALSE, ""); } static void test_message_attachment_without_filename(void) @@ -146,7 +146,7 @@ static void test_message_attachment_without_filename(void) "\n" "xxxdata\n"; - test_message_part_attachment(test_name, input, TRUE, NULL); + test_message_part_attachment(test_name, input, TRUE, ""); } static void test_message_attachment_with_cd_filename_star(void) -- 2.47.3