1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
|
$NetBSD: patch-ah,v 1.1 2008/07/13 16:26:17 tonnerre Exp $
--- perdition/imap4_in.c.orig 2005-06-22 07:50:05.000000000 +0200
+++ perdition/imap4_in.c
@@ -277,6 +277,76 @@ int imap4_in_authenticate(
#endif /* WITH_PAM_SUPPORT */
+/**********************************************************************
+ * imap4_in_verify_tag_str
+ * Verify that a tag is valid
+ * Pre: tag: io_t to write to
+ * Return 0 on success
+ * -1 otherwise
+ **********************************************************************/
+
+/* Excerpts from rfc3501, Section 9. Formal Syntax
+ *
+ * The ASCII NUL character, %x00, MUST NOT be used at any time.
+ *
+ * tag = 1*<any ASTRING-CHAR except "+">
+ *
+ * ATOM-CHAR = <any CHAR except atom-specials>
+ *
+ * atom-specials = "(" / ")" / "{" / SP / CTL / list-wildcards /
+ * quoted-specials / resp-specials
+ *
+ * list-wildcards = "%" / "*"
+ *
+ * quoted-specials = DQUOTE / "\"
+ *
+ * resp-specials = "]"
+ *
+ * Excerpts from rfc2060, Section 9. Formal Syntax
+ *
+ * CHAR ::= <any 7-bit US-ASCII character except NUL,
+ * 0x01 - 0x7f>
+ *
+ * CTL ::= <any ASCII control character and DEL,
+ * 0x00 - 0x1f, 0x7f>
+ */
+
+static int imap4_in_verify_tag_str(const token_t *tag)
+{
+ unsigned char *tag_str;
+ size_t tag_str_len, i;
+
+ tag_str_len = token_len(tag);
+
+ if (!tag_str_len)
+ return -1;
+
+ tag_str = token_buf(tag);
+
+ for (i = 0; i < tag_str_len; i++) {
+ /* Must be ASCII, must not be a control character */
+ if (tag_str[i] <= 0x1f || tag_str[i] >= 0x7f)
+ return -1;
+ /* Must not be other reserved characters */
+ switch(tag_str[i]) {
+ case '\0':
+ case '(':
+ case ')':
+ case '{':
+ case ' ':
+ case '%':
+ case '*':
+ case '"':
+ case '\\':
+ case ']':
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+
/**********************************************************************
* imap4_in_get_pw
@@ -337,19 +407,20 @@ int imap4_in_get_pw(io_t *io, struct pas
break;
}
+ if (imap4_in_verify_tag_str(tag)) {
+ token_assign(tag, (unsigned char *)strdup(IMAP4_UNTAGGED),
+ strlen(IMAP4_UNTAGGED), 0);
+ __IMAP4_IN_BAD("Invalid tag, mate");
+ goto loop;
+ }
+
if((q=vanessa_queue_pop(q, (void **)&tag))==NULL){
VANESSA_LOGGER_DEBUG("vanessa_queue_pop 1");
break;
}
if(token_is_eol(tag)){
- if(token_is_null(tag)){
- token_assign(tag, strdup(IMAP4_BAD), strlen(IMAP4_BAD), 0);
- __IMAP4_IN_BAD("Null tag, mate");
- }
- else {
- __IMAP4_IN_BAD("Missing command, mate");
- }
+ __IMAP4_IN_BAD("Missing command, mate");
goto loop;
}
|
