]> dgit.raspbian.org Git - dovecot.git/commit
[PATCH 1/2] imap-hibernate: Fix out-of-bounds read when parsing DONE command tag
authorTimo Sirainen <timo.sirainen@open-xchange.com>
Thu, 16 Apr 2026 21:12:13 +0000 (23:12 +0200)
committerNoah Meyerhans <noahm@debian.org>
Wed, 16 Sep 2026 19:06:35 +0000 (15:06 -0400)
commit031e149d4c748659fe3470fb747c1c5878b5a1fb
treea73367bf480784a53c83a6297941bae47310eae2
parent87322608f13b6c519fc73fb84f890587289eaced
[PATCH 1/2] imap-hibernate: Fix out-of-bounds read when parsing DONE command tag

The tag-skipping loop was missing a size>0 guard, so a malformed
DONE command with no space/CR/tab terminator after the tag would
read one byte past the end of the buffer. Also add a \0 check to
stop on embedded null bytes, which are not valid tag characters.

Gbp-Pq: Name 0001-imap-hibernate-Fix-out-of-bounds-read-when-parsing-D.patch
src/imap-hibernate/imap-client.c