Skip to content

doveadm: client-connection-tcp - Don't read past args in flag loop#300

Open
nishat-06 wants to merge 1 commit into
dovecot:mainfrom
nishat-06:doveadm-flag-args-overread
Open

doveadm: client-connection-tcp - Don't read past args in flag loop#300
nishat-06 wants to merge 1 commit into
dovecot:mainfrom
nishat-06:doveadm-flag-args-overread

Conversation

@nishat-06

Copy link
Copy Markdown
Contributor

client_handle_command_ctx() checks argc>=3 once, before the flag loop, but each 'x' (extra-fields) flag then consumes an args slot with no further check, and the username and command name take two more after it. A doveadm command line whose flag field holds more flag-consumers than there are following arguments makes args walk past the NULL terminator of the t_strsplit_tabescaped() array: with flags "xx" on a three-field line, cmd_name = args[0] reads one entry past the array and argc underflows to UINT_MAX before it reaches doveadm_cmd_handle(). Re-check argc before taking the extra-fields argument and before reading the username and command name.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant