Skip to content

Commit 615edc1

Browse files
bagderbagder
committed
sasl_getmesssage: make sure we have a long enough string to pass
For pop3/imap/smtp, added test 891 to somewhat verify the pop3 case. For this, I enhanced the pingpong test server to be able to send back responses with LF-only instead of always using CRLF. Closes #2150
1 parent 4401409 commit 615edc1

File tree

7 files changed

+112
-42
lines changed

7 files changed

+112
-42
lines changed

‎lib/imap.c

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -344,23 +344,28 @@ static bool imap_endofresp(struct connectdata *conn, char *line, size_t len,
344344
*/
345345
static void imap_get_message(char *buffer, char **outptr)
346346
{
347-
size_t len = 0;
347+
size_t len = strlen(buffer);
348348
char *message = NULL;
349349

350-
/* Find the start of the message */
351-
for(message = buffer + 2; *message == ' ' || *message == '\t'; message++)
352-
;
350+
if(len > 2) {
351+
/* Find the start of the message */
352+
for(message = buffer + 2; *message == ' ' || *message == '\t'; message++)
353+
;
353354

354-
/* Find the end of the message */
355-
for(len = strlen(message); len--;)
356-
if(message[len] != '\r' && message[len] != '\n' && message[len] != ' ' &&
357-
message[len] != '\t')
358-
break;
355+
/* Find the end of the message */
356+
for(len -= 2; len--;)
357+
if(message[len] != '\r' && message[len] != '\n' && message[len] != ' ' &&
358+
message[len] != '\t')
359+
break;
359360

360-
/* Terminate the message */
361-
if(++len) {
362-
message[len] = '\0';
361+
/* Terminate the message */
362+
if(++len) {
363+
message[len] = '\0';
364+
}
363365
}
366+
else
367+
/* junk input => zero length output */
368+
message = &buffer[len];
364369

365370
*outptr = message;
366371
}

‎lib/pop3.c

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -243,23 +243,28 @@ static bool pop3_endofresp(struct connectdata *conn, char *line, size_t len,
243243
*/
244244
static void pop3_get_message(char *buffer, char **outptr)
245245
{
246-
size_t len = 0;
246+
size_t len = strlen(buffer);
247247
char *message = NULL;
248248

249-
/* Find the start of the message */
250-
for(message = buffer + 2; *message == ' ' || *message == '\t'; message++)
251-
;
249+
if(len > 2) {
250+
/* Find the start of the message */
251+
for(message = buffer + 2; *message == ' ' || *message == '\t'; message++)
252+
;
252253

253-
/* Find the end of the message */
254-
for(len = strlen(message); len--;)
255-
if(message[len] != '\r' && message[len] != '\n' && message[len] != ' ' &&
256-
message[len] != '\t')
257-
break;
254+
/* Find the end of the message */
255+
for(len -= 2; len--;)
256+
if(message[len] != '\r' && message[len] != '\n' && message[len] != ' ' &&
257+
message[len] != '\t')
258+
break;
258259

259-
/* Terminate the message */
260-
if(++len) {
261-
message[len] = '\0';
260+
/* Terminate the message */
261+
if(++len) {
262+
message[len] = '\0';
263+
}
262264
}
265+
else
266+
/* junk input => zero length output */
267+
message = &buffer[len];
263268

264269
*outptr = message;
265270
}

‎lib/smtp.c

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -232,23 +232,28 @@ static bool smtp_endofresp(struct connectdata *conn, char *line, size_t len,
232232
*/
233233
static void smtp_get_message(char *buffer, char **outptr)
234234
{
235-
size_t len = 0;
235+
size_t len = strlen(buffer);
236236
char *message = NULL;
237237

238-
/* Find the start of the message */
239-
for(message = buffer + 4; *message == ' ' || *message == '\t'; message++)
240-
;
238+
if(len > 4) {
239+
/* Find the start of the message */
240+
for(message = buffer + 4; *message == ' ' || *message == '\t'; message++)
241+
;
241242

242-
/* Find the end of the message */
243-
for(len = strlen(message); len--;)
244-
if(message[len] != '\r' && message[len] != '\n' && message[len] != ' ' &&
245-
message[len] != '\t')
246-
break;
243+
/* Find the end of the message */
244+
for(len -= 4; len--;)
245+
if(message[len] != '\r' && message[len] != '\n' && message[len] != ' ' &&
246+
message[len] != '\t')
247+
break;
247248

248-
/* Terminate the message */
249-
if(++len) {
250-
message[len] = '\0';
249+
/* Terminate the message */
250+
if(++len) {
251+
message[len] = '\0';
252+
}
251253
}
254+
else
255+
/* junk input => zero length output */
256+
message = &buffer[len];
252257

253258
*outptr = message;
254259
}

‎tests/FILEFORMAT

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,8 @@ REPLY [command] [return value] [response string]
124124
evaluated as a perl string, so it can contain embedded \r\n, for example.
125125
There's a special [command] named "welcome" (without quotes) which is the
126126
string sent immediately on connect as a welcome.
127+
REPLYLF (like above but sends the response terminated with LF-only and not
128+
CRLF)
127129
COUNT [command] [num]
128130
- Do the REPLY change for [command] only [num] times and then go back to the
129131
built-in approach

‎tests/data/Makefile.inc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ test850 test851 test852 test853 test854 test855 test856 test857 test858 \
9595
test859 test860 test861 test862 test863 test864 test865 test866 test867 \
9696
test868 test869 test870 test871 test872 test873 test874 test875 test876 \
9797
test877 test878 test879 test880 test881 test882 test883 test884 test885 \
98-
test886 test887 test888 test889 test890 \
98+
test886 test887 test888 test889 test890 test891 \
9999
\
100100
test900 test901 test902 test903 test904 test905 test906 test907 test908 \
101101
test909 test910 test911 test912 test913 test914 test915 test916 test917 \

‎tests/data/test891

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
<testcase>
2+
<info>
3+
<keywords>
4+
POP3
5+
</keywords>
6+
</info>
7+
8+
#
9+
# Server-side
10+
<reply>
11+
<servercmd>
12+
AUTH CRAM-MD5
13+
REPLYLF AUTH +
14+
</servercmd>
15+
</reply>
16+
17+
#
18+
# Client-side
19+
<client>
20+
<server>
21+
pop3
22+
</server>
23+
<features>
24+
crypto
25+
</features>
26+
<name>
27+
POP3 with short authentication response
28+
</name>
29+
<command>
30+
pop3://%HOSTIP:%POP3PORT/891 -u user:secret
31+
</command>
32+
</client>
33+
34+
#
35+
# Verify data after the test has been "shot"
36+
<verify>
37+
<protocol>
38+
CAPA
39+
AUTH CRAM-MD5
40+
dXNlciA1YzhkYjAzZjA0Y2VjMGY0M2JjYjA2MDAyMzkxNDE5MA==
41+
</protocol>
42+
# CURLE_LOGIN_DENIED
43+
<errorcode>
44+
67
45+
</errorcode>
46+
</verify>
47+
</testcase>

‎tests/ftpserver.pl

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2755,13 +2755,19 @@ sub customize {
27552755
$fulltextreply{$1}=eval "qq{$2}";
27562756
logmsg "FTPD: set custom reply for $1\n";
27572757
}
2758-
elsif($_ =~ /REPLY ([A-Za-z0-9+\/=\*]*) (.*)/) {
2759-
$commandreply{$1}=eval "qq{$2}";
2760-
if($1 eq "") {
2758+
elsif($_ =~ /REPLY(LF|) ([A-Za-z0-9+\/=\*]*) (.*)/) {
2759+
$commandreply{$2}=eval "qq{$3}";
2760+
if($1 ne "LF") {
2761+
$commandreply{$2}.="\r\n";
2762+
}
2763+
else {
2764+
$commandreply{$2}.="\n";
2765+
}
2766+
if($2 eq "") {
27612767
logmsg "FTPD: set custom reply for empty command\n";
27622768
}
27632769
else {
2764-
logmsg "FTPD: set custom reply for $1 command\n";
2770+
logmsg "FTPD: set custom reply for $2 command\n";
27652771
}
27662772
}
27672773
elsif($_ =~ /COUNT ([A-Z]+) (.*)/) {
@@ -3175,7 +3181,7 @@ sub customize {
31753181
$commandreply{$FTPCMD}="";
31763182
}
31773183

3178-
sendcontrol "$text\r\n";
3184+
sendcontrol $text;
31793185
$check = 0;
31803186
}
31813187
else {

0 commit comments

Comments
 (0)