]> git.ipfire.org Git - thirdparty/dovecot/core.git/commit
lib-sasl: sasl-server-mech-otp - Fix parsing of authid from initial client response
authorStephan Bosch <stephan.bosch@open-xchange.com>
Thu, 30 Oct 2025 23:19:45 +0000 (00:19 +0100)
committeraki.tuomi <aki.tuomi@open-xchange.com>
Fri, 31 Oct 2025 19:58:23 +0000 (19:58 +0000)
commitb8a514b896254a97f111fd54e459b27d3ad70216
tree7b7cc24eb93dcb4c2394ffaeed018a64bf5e0126
parent6647866bfb9375437b4a4784f8dc72e4f439a220
lib-sasl: sasl-server-mech-otp - Fix parsing of authid from initial client response

Before, it assumed this part to be nul-terminated, while it is not. Therefore,
it could read out-of-bounds memory, possibly crashing, which is wat became
apparent in the fuzzer.

The actual auth service code implicitly always provides a NUL termination
though, because the client response data comes via t_buffer_create() content
which always reserves +1 byte for NUL. Therefore, the auth service would not
have encountered this issue.

OSS-Fuzz report: 456423266
src/lib-sasl/sasl-server-mech-otp.c