dovecot23/dovecot-2.3.0.1-over-quota-lmtp-crash.patch

From 2bf919786518d138cc07d9cc21e14ad5e07e5e56 Mon Sep 17 00:00:00 2001
From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Wed, 17 Jan 2018 21:26:44 +0100
Subject: [PATCH] lmtp: local: Fix segfault occurring when quota is exceeded.

---
 src/lmtp/lmtp-local.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lmtp/lmtp-local.c b/src/lmtp/lmtp-local.c
index fa1ce5d869..5b5fe51a95 100644
--- a/src/lmtp/lmtp-local.c
+++ b/src/lmtp/lmtp-local.c
@@ -133,7 +133,7 @@ static void
 lmtp_local_rcpt_reply_overquota(struct lmtp_local_recipient *rcpt,
 				const char *error)
 {
-	struct smtp_address *address = rcpt->rcpt.rcpt->path;
+	struct smtp_address *address = rcpt->rcpt.path;
 	struct lda_settings *lda_set =
 		mail_storage_service_user_get_set(rcpt->service_user)[2];
 
From cdbcc8db8e0a04b2cbf6ca9f20b3ee7f7173552d Mon Sep 17 00:00:00 2001
From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Wed, 31 Jan 2018 10:30:23 +0100
Subject: [PATCH 1/3] lmtp: local: Make local variable for rcpt->rcpt.rcpt_cmd
 in lmtp_local_rcpt_check_quota().

---
 src/lmtp/lmtp-local.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/lmtp/lmtp-local.c b/src/lmtp/lmtp-local.c
index c770e35e5b..d0ee4b312e 100644
--- a/src/lmtp/lmtp-local.c
+++ b/src/lmtp/lmtp-local.c
@@ -195,6 +195,7 @@ static int
 lmtp_local_rcpt_check_quota(struct lmtp_local_recipient *rcpt)
 {
 	struct client *client = rcpt->rcpt.client;
+	struct smtp_server_cmd_ctx *cmd = rcpt->rcpt.rcpt_cmd;
 	struct smtp_address *address = rcpt->rcpt.path;
 	struct mail_user *user;
 	struct mail_namespace *ns;
@@ -245,10 +246,10 @@ lmtp_local_rcpt_check_quota(struct lmtp_local_recipient *rcpt)
 	}
 
 	if (ret < 0 &&
-		!smtp_server_command_is_replied(rcpt->rcpt.rcpt_cmd->cmd)) {
-		smtp_server_reply(rcpt->rcpt.rcpt_cmd,
-			451, "4.3.0", "<%s> Temporary internal error",
-			smtp_address_encode(address));
+		!smtp_server_command_is_replied(cmd->cmd)) {
+		smtp_server_reply(cmd, 451, "4.3.0",
+				  "<%s> Temporary internal error",
+				  smtp_address_encode(address));
 	}
 	return ret;
 }

From c23717da4af9d3275cb45cbc67faaa8daa353ec1 Mon Sep 17 00:00:00 2001
From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Wed, 31 Jan 2018 10:34:11 +0100
Subject: [PATCH 2/3] lmtp: local: Add explicit cmd parameter to
 lmtp_local_rcpt_reply_overquota().

Using the RCPT cmd is only valid for the RCPT command and not when quota excess
is detected during DATA. That would cause a segmentation fault, since
rcpt->rcpt.rcpt_cmd == NULL.
---
 src/lmtp/lmtp-local.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/src/lmtp/lmtp-local.c b/src/lmtp/lmtp-local.c
index d0ee4b312e..c19c449e61 100644
--- a/src/lmtp/lmtp-local.c
+++ b/src/lmtp/lmtp-local.c
@@ -134,6 +134,7 @@ lmtp_local_rcpt_deinit(struct lmtp_local_recipient *rcpt)
 
 static void
 lmtp_local_rcpt_reply_overquota(struct lmtp_local_recipient *rcpt,
+				struct smtp_server_cmd_ctx *cmd,
 				const char *error)
 {
 	struct smtp_address *address = rcpt->rcpt.path;
@@ -141,13 +142,11 @@ lmtp_local_rcpt_reply_overquota(struct lmtp_local_recipient *rcpt,
 		mail_storage_service_user_get_set(rcpt->service_user)[2];
 
 	if (lda_set->quota_full_tempfail) {
-		smtp_server_reply(rcpt->rcpt.rcpt_cmd,
-			452, "4.2.2", "<%s> %s",
-			smtp_address_encode(address), error);
+		smtp_server_reply(cmd, 452, "4.2.2", "<%s> %s",
+				  smtp_address_encode(address), error);
 	} else {
-		smtp_server_reply(rcpt->rcpt.rcpt_cmd,
-			552, "5.2.2", "<%s> %s",
-			smtp_address_encode(address), error);
+		smtp_server_reply(cmd, 552, "5.2.2", "<%s> %s",
+				  smtp_address_encode(address), error);
 	}
 }
 
@@ -232,7 +231,7 @@ lmtp_local_rcpt_check_quota(struct lmtp_local_recipient *rcpt)
 		if (ret < 0) {
 			error = mailbox_get_last_error(box, &mail_error);
 			if (mail_error == MAIL_ERROR_NOQUOTA) {
-				lmtp_local_rcpt_reply_overquota(rcpt, error);
+				lmtp_local_rcpt_reply_overquota(rcpt, cmd, error);
 			} else {
 				i_error("mailbox_get_status(%s, STATUS_CHECK_OVER_QUOTA) "
 					"failed: %s",
@@ -623,7 +622,7 @@ lmtp_local_deliver(struct lmtp_local *local,
 	} else if (storage != NULL) {
 		error = mail_storage_get_last_error(storage, &mail_error);
 		if (mail_error == MAIL_ERROR_NOQUOTA) {
-			lmtp_local_rcpt_reply_overquota(rcpt, error);
+			lmtp_local_rcpt_reply_overquota(rcpt, cmd, error);
 		} else {
 			smtp_server_reply_index(cmd, rcpt_idx,
 				451, "4.2.0", "<%s> %s",

From f8d9e6c977847a411af9986c9be62f74e4b06143 Mon Sep 17 00:00:00 2001
From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Wed, 31 Jan 2018 10:27:54 +0100
Subject: [PATCH 3/3] lmtp: local: Use recipient index in
 lmtp_local_rcpt_reply_overquota().

When used during the DATA command, it should send a reply for the correct
recipient. During the RCPT command there is only one reply due. Added assert
that checks this.
---
 src/lmtp/lmtp-local.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/lmtp/lmtp-local.c b/src/lmtp/lmtp-local.c
index c19c449e61..0b5e7e06ec 100644
--- a/src/lmtp/lmtp-local.c
+++ b/src/lmtp/lmtp-local.c
@@ -138,15 +138,18 @@ lmtp_local_rcpt_reply_overquota(struct lmtp_local_recipient *rcpt,
 				const char *error)
 {
 	struct smtp_address *address = rcpt->rcpt.path;
+	unsigned int rcpt_idx = rcpt->rcpt.index;
 	struct lda_settings *lda_set =
 		mail_storage_service_user_get_set(rcpt->service_user)[2];
 
+	i_assert(rcpt_idx == 0 || rcpt->rcpt.rcpt_cmd == NULL);
+
 	if (lda_set->quota_full_tempfail) {
-		smtp_server_reply(cmd, 452, "4.2.2", "<%s> %s",
-				  smtp_address_encode(address), error);
+		smtp_server_reply_index(cmd, rcpt_idx, 452, "4.2.2", "<%s> %s",
+					smtp_address_encode(address), error);
 	} else {
-		smtp_server_reply(cmd, 552, "5.2.2", "<%s> %s",
-				  smtp_address_encode(address), error);
+		smtp_server_reply_index(cmd, rcpt_idx, 552, "5.2.2", "<%s> %s",
+					smtp_address_encode(address), error);
 	}
 }