From 2bf919786518d138cc07d9cc21e14ad5e07e5e56 Mon Sep 17 00:00:00 2001 From: Stephan Bosch Date: Wed, 17 Jan 2018 21:26:44 +0100 Subject: [PATCH] lmtp: local: Fix segfault occurring when quota is exceeded. --- src/lmtp/lmtp-local.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lmtp/lmtp-local.c b/src/lmtp/lmtp-local.c index fa1ce5d869..5b5fe51a95 100644 --- a/src/lmtp/lmtp-local.c +++ b/src/lmtp/lmtp-local.c @@ -133,7 +133,7 @@ static void lmtp_local_rcpt_reply_overquota(struct lmtp_local_recipient *rcpt, const char *error) { - struct smtp_address *address = rcpt->rcpt.rcpt->path; + struct smtp_address *address = rcpt->rcpt.path; struct lda_settings *lda_set = mail_storage_service_user_get_set(rcpt->service_user)[2]; From cdbcc8db8e0a04b2cbf6ca9f20b3ee7f7173552d Mon Sep 17 00:00:00 2001 From: Stephan Bosch Date: Wed, 31 Jan 2018 10:30:23 +0100 Subject: [PATCH 1/3] lmtp: local: Make local variable for rcpt->rcpt.rcpt_cmd in lmtp_local_rcpt_check_quota(). --- src/lmtp/lmtp-local.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/lmtp/lmtp-local.c b/src/lmtp/lmtp-local.c index c770e35e5b..d0ee4b312e 100644 --- a/src/lmtp/lmtp-local.c +++ b/src/lmtp/lmtp-local.c @@ -195,6 +195,7 @@ static int lmtp_local_rcpt_check_quota(struct lmtp_local_recipient *rcpt) { struct client *client = rcpt->rcpt.client; + struct smtp_server_cmd_ctx *cmd = rcpt->rcpt.rcpt_cmd; struct smtp_address *address = rcpt->rcpt.path; struct mail_user *user; struct mail_namespace *ns; @@ -245,10 +246,10 @@ lmtp_local_rcpt_check_quota(struct lmtp_local_recipient *rcpt) } if (ret < 0 && - !smtp_server_command_is_replied(rcpt->rcpt.rcpt_cmd->cmd)) { - smtp_server_reply(rcpt->rcpt.rcpt_cmd, - 451, "4.3.0", "<%s> Temporary internal error", - smtp_address_encode(address)); + !smtp_server_command_is_replied(cmd->cmd)) { + smtp_server_reply(cmd, 451, "4.3.0", + "<%s> Temporary internal error", + smtp_address_encode(address)); } return ret; } From c23717da4af9d3275cb45cbc67faaa8daa353ec1 Mon Sep 17 00:00:00 2001 From: Stephan Bosch Date: Wed, 31 Jan 2018 10:34:11 +0100 Subject: [PATCH 2/3] lmtp: local: Add explicit cmd parameter to lmtp_local_rcpt_reply_overquota(). Using the RCPT cmd is only valid for the RCPT command and not when quota excess is detected during DATA. That would cause a segmentation fault, since rcpt->rcpt.rcpt_cmd == NULL. --- src/lmtp/lmtp-local.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/src/lmtp/lmtp-local.c b/src/lmtp/lmtp-local.c index d0ee4b312e..c19c449e61 100644 --- a/src/lmtp/lmtp-local.c +++ b/src/lmtp/lmtp-local.c @@ -134,6 +134,7 @@ lmtp_local_rcpt_deinit(struct lmtp_local_recipient *rcpt) static void lmtp_local_rcpt_reply_overquota(struct lmtp_local_recipient *rcpt, + struct smtp_server_cmd_ctx *cmd, const char *error) { struct smtp_address *address = rcpt->rcpt.path; @@ -141,13 +142,11 @@ lmtp_local_rcpt_reply_overquota(struct lmtp_local_recipient *rcpt, mail_storage_service_user_get_set(rcpt->service_user)[2]; if (lda_set->quota_full_tempfail) { - smtp_server_reply(rcpt->rcpt.rcpt_cmd, - 452, "4.2.2", "<%s> %s", - smtp_address_encode(address), error); + smtp_server_reply(cmd, 452, "4.2.2", "<%s> %s", + smtp_address_encode(address), error); } else { - smtp_server_reply(rcpt->rcpt.rcpt_cmd, - 552, "5.2.2", "<%s> %s", - smtp_address_encode(address), error); + smtp_server_reply(cmd, 552, "5.2.2", "<%s> %s", + smtp_address_encode(address), error); } } @@ -232,7 +231,7 @@ lmtp_local_rcpt_check_quota(struct lmtp_local_recipient *rcpt) if (ret < 0) { error = mailbox_get_last_error(box, &mail_error); if (mail_error == MAIL_ERROR_NOQUOTA) { - lmtp_local_rcpt_reply_overquota(rcpt, error); + lmtp_local_rcpt_reply_overquota(rcpt, cmd, error); } else { i_error("mailbox_get_status(%s, STATUS_CHECK_OVER_QUOTA) " "failed: %s", @@ -623,7 +622,7 @@ lmtp_local_deliver(struct lmtp_local *local, } else if (storage != NULL) { error = mail_storage_get_last_error(storage, &mail_error); if (mail_error == MAIL_ERROR_NOQUOTA) { - lmtp_local_rcpt_reply_overquota(rcpt, error); + lmtp_local_rcpt_reply_overquota(rcpt, cmd, error); } else { smtp_server_reply_index(cmd, rcpt_idx, 451, "4.2.0", "<%s> %s", From f8d9e6c977847a411af9986c9be62f74e4b06143 Mon Sep 17 00:00:00 2001 From: Stephan Bosch Date: Wed, 31 Jan 2018 10:27:54 +0100 Subject: [PATCH 3/3] lmtp: local: Use recipient index in lmtp_local_rcpt_reply_overquota(). When used during the DATA command, it should send a reply for the correct recipient. During the RCPT command there is only one reply due. Added assert that checks this. --- src/lmtp/lmtp-local.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/lmtp/lmtp-local.c b/src/lmtp/lmtp-local.c index c19c449e61..0b5e7e06ec 100644 --- a/src/lmtp/lmtp-local.c +++ b/src/lmtp/lmtp-local.c @@ -138,15 +138,18 @@ lmtp_local_rcpt_reply_overquota(struct lmtp_local_recipient *rcpt, const char *error) { struct smtp_address *address = rcpt->rcpt.path; + unsigned int rcpt_idx = rcpt->rcpt.index; struct lda_settings *lda_set = mail_storage_service_user_get_set(rcpt->service_user)[2]; + i_assert(rcpt_idx == 0 || rcpt->rcpt.rcpt_cmd == NULL); + if (lda_set->quota_full_tempfail) { - smtp_server_reply(cmd, 452, "4.2.2", "<%s> %s", - smtp_address_encode(address), error); + smtp_server_reply_index(cmd, rcpt_idx, 452, "4.2.2", "<%s> %s", + smtp_address_encode(address), error); } else { - smtp_server_reply(cmd, 552, "5.2.2", "<%s> %s", - smtp_address_encode(address), error); + smtp_server_reply_index(cmd, rcpt_idx, 552, "5.2.2", "<%s> %s", + smtp_address_encode(address), error); } }