[patch] Fix for returning NULL values in SQL dict lookups

NederHost/Sebastiaan Hoogeveen
Wed, 11 May 2016 20:49:35 -0000

Hi,

I noticed a bug doing dict lookups on an SQLite database which had NULL values
in its columns; a segmentation fault occurred, probably due to a null pointer
dereference in str_tabescape. The problem is that sqlite3_column_text returns a
null pointer for column values which are (SQL) NULL. It seems the other database
drivers do something similar. The following patch makes the dict server check
for null pointers and return a 'not found' reply in those cases (I
changed the order around in the decision tree to avoid having to repeat return
values):

diff -Naur dovecot-2.2.24/src/dict/dict-commands.c
dovecot-2.2.24-patched/src/dict/dict-commands.c
--- dovecot-2.2.24/src/dict/dict-commands.c     2016-04-26 15:01:20.000000000
+0200
+++ dovecot-2.2.24-patched/src/dict/dict-commands.c     2016-05-11
22:04:06.000000000 +0200
@@ -83,14 +83,14 @@
 {
        struct dict_connection_cmd *cmd = context;

-       if (result->ret > 0) {
+       if (result->ret > 0 && result->value) {
                cmd->reply = i_strdup_printf("%c%s\n",
                        DICT_PROTOCOL_REPLY_OK,
str_tabescape(result->value));
-       } else if (result->ret == 0) {
-               cmd->reply = i_strdup_printf("%c\n",
DICT_PROTOCOL_REPLY_NOTFOUND);
-       } else {
+       } else if (result->ret < 0) {
                i_error("%s", result->error);
                cmd->reply = i_strdup_printf("%c\n",
DICT_PROTOCOL_REPLY_FAIL);
+       } else {
+               cmd->reply = i_strdup_printf("%c\n",
DICT_PROTOCOL_REPLY_NOTFOUND);
        }
        dict_connection_cmds_flush(cmd->conn);
 }


Kind regards,

--
Sebastiaan Hoogeveen

NederHost
https://www.nederhost.nl/
KvK: 34099781