[PATCH 24/24] auth: passdb-sql - Require update_query to be set when used

Gbp-Pq: Name CVE-2026-27855-4.patch

diff --git a/src/auth/passdb-sql.c b/src/auth/passdb-sql.c
index 28291606eada8407788d546036ce17860fbba70a..ec160e3d7582c61466024523c98c0d8589e3ad8a 100644 (file)
--- a/src/auth/passdb-sql.c
+++ b/src/auth/passdb-sql.c
@@ -270,6 +270,12 @@ static void sql_set_credentials(struct auth_request *request,
                return;
        }
 
+       if (*set->update_query == '\0') {
+               e_error(authdb_event(request), "passdb_sql_update_query is empty");
+               callback(FALSE, request);
+               return;
+       }
+
        sql_request = i_new(struct passdb_sql_request, 1);
        sql_request->auth_request = request;
        sql_request->callback.set_credentials = callback;