changeset: 6457:3bbb1f569eb1
user:      Kevin McCarthy <[email protected]>
date:      Fri Jun 26 12:23:26 2015 -0700
link:      http://dev.mutt.org/hg/mutt/rev/3bbb1f569eb1

Fix IMAP segfault due to NULL capstr.

After a failed login, the connection is left open but capstr is freed.
If a second login attempt is made, imap_auth_sasl was trying to strstr
using the NULL capstr.

Add a NONULL around the capstr parameter to strstr.  Change
imap_conn_find() to keep the capstr around until a successful
authentication occurs.

diffs (32 lines):

diff -r b4be5796a458 -r 3bbb1f569eb1 imap/auth_sasl.c
--- a/imap/auth_sasl.c  Fri Jun 26 11:38:16 2015 -0700
+++ b/imap/auth_sasl.c  Fri Jun 26 12:23:26 2015 -0700
@@ -70,7 +70,7 @@
       rc = sasl_client_start (saslconn, "AUTH=ANONYMOUS", NULL, &pc, &olen, 
                               &mech);
   } else if (!ascii_strcasecmp ("login", method) &&
-       !strstr (idata->capstr, "AUTH=LOGIN"))
+       !strstr (NONULL (idata->capstr), "AUTH=LOGIN"))
     /* do not use SASL login for regular IMAP login (#3556) */
     return IMAP_AUTH_UNAVAIL;
   
diff -r b4be5796a458 -r 3bbb1f569eb1 imap/imap.c
--- a/imap/imap.c       Fri Jun 26 11:38:16 2015 -0700
+++ b/imap/imap.c       Fri Jun 26 12:23:26 2015 -0700
@@ -373,6 +373,7 @@
     if (!imap_authenticate (idata))
     {
       idata->state = IMAP_AUTHENTICATED;
+      FREE (&idata->capstr);
       new = 1;
       if (idata->conn->ssf)
        dprint (2, (debugfile, "Communication encrypted at %d bits\n",
@@ -380,8 +381,6 @@
     }
     else
       mutt_account_unsetpass (&idata->conn->account);
-
-    FREE (&idata->capstr);
   }
   if (new && idata->state == IMAP_AUTHENTICATED)
   {

Reply via email to