dovecot - Oct 2008 - 1.1.5 abort with mal-formed address in header

Hi

An email with a mal-formed address in a header like:

To:(receiver at domain.com

(Starting with a comment, with no closing ')' ) causes dovecot 1.1.5  
to panic and abort.

This is similar to the problem fixed by: http://hg.dovecot.org/ 
dovecot-1.1/rev/04fdaa2f831e

This patch seems to resolve the problem:

--- dovecot-1.1.5/src/lib-mail/message-address.c.orig   2008-10-23  
22:17:10.243827000 +0000
+++ dovecot-1.1.5/src/lib-mail/message-address.c        2008-10-23  
22:20:20.050173000 +0000
@@ -315,7 +315,7 @@
         ctx.fill_missing = fill_missing;

         ret = rfc822_skip_lwsp(&ctx.parser);
-       if (ret == 0) {
+       if (ret <= 0) {
                 /* no addresses */
                 return NULL;
         }



Richard Platel
rplatel at tucows.com

On Oct 24, 2008, at 1:49 AM, Richard Platel wrote:
> To:(receiver at domain.com
>
> (Starting with a comment, with no closing ')' ) causes dovecot
1.1.5
> to panic and abort.
>
> This is similar to the problem fixed by:
http://hg.dovecot.org/dovecot-1.1/rev/04fdaa2f831e
>
> This patch seems to resolve the problem:
Thanks, committed. I guess it's time for 1.1.6 release.. I'll leave it  
for tomorrow.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 194 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20081024/d630690b/attachment-0002.bin>

On Friday 24 of October 2008, Timo Sirainen wrote:
> On Oct 24, 2008, at 1:49 AM, Richard Platel wrote:
> > To:(receiver at domain.com
> >
> > (Starting with a comment, with no closing ')' ) causes dovecot
1.1.5
> > to panic and abort.
> >
> > This is similar to the problem fixed by:
> > http://hg.dovecot.org/dovecot-1.1/rev/04fdaa2f831e
> >
> > This patch seems to resolve the problem:
>
> Thanks, committed. I guess it's time for 1.1.6 release.. I'll leave
it
> for tomorrow.
Ping? :-)

-- 
Arkadiusz Mi?kiewicz        PLD/Linux Team
arekm / maven.pl            http://ftp.pld-linux.org/