From 16e047c54ca23f6fd585734c4f11c683df4a21eb Mon Sep 17 00:00:00 2001
From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Fri, 10 May 2019 19:43:55 +0300
Subject: [PATCH] lib-managesieve: Don't accept strings with NULs
ManageSieve doesn't allow NULs in strings.
This fixes a bug with unescaping a string with NULs: str_unescape() could
have been called for memory that points outside the allocated string,
causing heap corruption. This could cause crashes or theoretically even
result in remote code execution exploit.
Found by Nick Roessler and Rafi Rubin
---
src/lib-managesieve/managesieve-parser.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/lib-managesieve/managesieve-parser.c b/src/lib-managesieve/managesieve-parser.c
index d3eb21012..f5f9d3232 100644
--- a/src/lib-managesieve/managesieve-parser.c
+++ b/src/lib-managesieve/managesieve-parser.c
@@ -258,6 +258,11 @@ managesieve_parser_read_string(struct managesieve_parser *parser,
break;
}
+ if (data[i] == '\0') {
+ parser->error = "NULs not allowed in strings";
+ return FALSE;
+ }
+
if (data[i] == '\\') {
if (i+1 == data_size) {
/* known data ends with '\' - leave it to
--
GitLab