[GNUnet-SVN] [gnurl] 195/220: smtp: check for and bail out on too short EHLO response

[gnunet]

This is an automated email from the git hooks/post-receive script.

ng0 pushed a commit to branch master
in repository gnurl.

commit 4d0306c6982ad80be532438265c52c39a55889a0
Author: Daniel Stenberg <address@hidden>
AuthorDate: Mon Sep 2 23:04:26 2019 +0200

    smtp: check for and bail out on too short EHLO response
    
    Otherwise, a three byte response would make the smtp_state_ehlo_resp()
    function misbehave.
    
    Credit to OSS-Fuzz
    Bug: https://crbug.com/oss-fuzz/16918
    
    Assisted-by: Max Dymond
    
    Closes #4287
---
 lib/smtp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/smtp.c b/lib/smtp.c
index 0db3c1e1c..65220b0f6 100644
--- a/lib/smtp.c
+++ b/lib/smtp.c
@@ -714,7 +714,7 @@ static CURLcode smtp_state_ehlo_resp(struct connectdata 
*conn, int smtpcode,
       result = CURLE_REMOTE_ACCESS_DENIED;
     }
   }
-  else {
+  else if(len >= 4) {
     line += 4;
     len -= 4;
 
@@ -785,6 +785,10 @@ static CURLcode smtp_state_ehlo_resp(struct connectdata 
*conn, int smtpcode,
         result = smtp_perform_authentication(conn);
     }
   }
+  else {
+    failf(data, "Unexpectedly short EHLO response");
+    result = CURLE_WEIRD_SERVER_REPLY;
+  }
 
   return result;
 }

-- 
To stop receiving notification emails like this one, please contact
address@hidden.