From f0ea88118f21c79afcb85b3ff68eb84304c569ba Mon Sep 17 00:00:00 2001 From: Stephan Bosch Date: Fri, 20 Mar 2020 13:38:41 +0100 Subject: [PATCH] lmtp: lmtp-commands - Explicity prohibit empty RCPT path. The empty path <""> will yield an empty username. --- src/lmtp/lmtp-commands.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/lmtp/lmtp-commands.c b/src/lmtp/lmtp-commands.c index 2c0d57f2cb..2988c88730 100644 --- a/src/lmtp/lmtp-commands.c +++ b/src/lmtp/lmtp-commands.c @@ -66,10 +66,18 @@ int client_default_cmd_rcpt(struct client *client, char delim = '\0'; int ret; + i_assert(!smtp_address_isnull(rcpt->path)); + if (*rcpt->path->localpart == '\0' && rcpt->path->domain == NULL) { + smtp_server_recipient_reply( + rcpt, 550, "5.1.1", + "Unacceptable TO: Empty path not allowed"); + return -1; + } smtp_address_detail_parse_temp( client->unexpanded_lda_set->recipient_delimiter, rcpt->path, &username, &delim, &detail); + i_assert(*username != '\0'); /* Make user name and detail available in the recipient event. The mail_user event (for local delivery) also adds the user field, but -- 2.47.3