]> dgit.raspbian.org Git - dovecot.git/commit
[PATCH 3/3] lib-sieve: edit_mail_headers_parse() - Fix info leak via NUL-truncated...
authorTimo Sirainen <timo.sirainen@open-xchange.com>
Fri, 1 May 2026 06:28:33 +0000 (06:28 +0000)
committerNoah Meyerhans <noahm@debian.org>
Wed, 16 Sep 2026 19:06:35 +0000 (15:06 -0400)
commit57af15638a12a4f7e8b9a0a14b0ee74ff9f01585
treed6c51cb04a6f0278d3088dab08bc2a6705cf9adb
parent6f602e1a82e347f12203f5dddaf69726d256a323
[PATCH 3/3] lib-sieve: edit_mail_headers_parse() - Fix info leak via NUL-truncated header copy

i_strndup() stops at the first NUL byte, so embedded NULs caused field->data
to be shorter than field->size. This left stale heap data readable past the
copied content when callers treat data+body_offset as a string.

Adds a test-edit-mail unit test and a sieve testsuite case that both
exercise edit_mail_headers_parse() with a NUL byte embedded in a header
value. The unit test memcmp-verifies that the bytes after the NUL are
preserved; the sieve test triggers an invalid heap read detectable by
valgrind under the old code.

Gbp-Pq: Name 0003-lib-sieve-edit_mail_headers_parse-Fix-info-leak-via-.patch
pigeonhole/Makefile.am
pigeonhole/src/lib-sieve/util/edit-mail.c
pigeonhole/src/lib-sieve/util/test-edit-mail.c
pigeonhole/tests/extensions/editheader/nul-value.svtest [new file with mode: 0644]