From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Sun, 3 May 2026 16:24:38 +0000 (+0000)
Subject: [PATCH 2/2] login-common: Avoid array_front() panic on empty forward_fields array
X-Git-Tag: archive/raspbian/1%2.4.1+dfsg1-6+rpi1+deb13u7^2~1
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=814082258e6e99af81884d2df22ff08520d7a720;p=dovecot.git

[PATCH 2/2] login-common: Avoid array_front() panic on empty forward_fields array

sasl_server_auth_request_info_fill() and proxy_redirect_reauth()
NUL-terminate the forward_fields array via array_append_zero() +
array_pop_back() and then call array_front() to hand the C array to
the auth client. array_front() asserts when the array is empty, so a
created-but-empty forward_fields array crashes login.

The empty-array case is no longer reachable from
client_forward_decode_base64() after the previous commit, but guard
defensively here as well: any future caller that creates the array
without populating it should not be able to panic the process.

Gbp-Pq: Name 0002-login-common-Avoid-array_front-panic-on-empty-forwar.patch
---

diff --git a/src/login-common/client-common-auth.c b/src/login-common/client-common-auth.c
index 0b22649..36ed721 100644
--- a/src/login-common/client-common-auth.c
+++ b/src/login-common/client-common-auth.c
@@ -490,7 +490,7 @@ proxy_redirect_reauth(struct client *client, const char *destuser,
 	t_array_init(&info.extra_fields, N_ELEMENTS(extra_fields));
 	array_append(&info.extra_fields, extra_fields,
 		     N_ELEMENTS(extra_fields));
-	if (array_is_created(&client->forward_fields)) {
+	if (array_not_empty(&client->forward_fields)) {
 		array_append_zero(&client->forward_fields);
 		array_pop_back(&client->forward_fields);
 		info.forward_fields = array_front(&client->forward_fields);
diff --git a/src/login-common/sasl-server.c b/src/login-common/sasl-server.c
index f02262c..88d46e7 100644
--- a/src/login-common/sasl-server.c
+++ b/src/login-common/sasl-server.c
@@ -534,7 +534,7 @@ int sasl_server_auth_request_info_fill(struct client *client,
 	info_r->real_remote_port = client->real_remote_port;
 	if (client->client_id != NULL)
 		info_r->client_id = str_c(client->client_id);
-	if (array_is_created(&client->forward_fields)) {
+	if (array_not_empty(&client->forward_fields)) {
 		array_append_zero(&client->forward_fields);
 		array_pop_back(&client->forward_fields);
 		info_r->forward_fields = array_front(&client->forward_fields);