LMTP delivery segfaults when user is over quota.

[Stephan Bosch]

Op 3/4/2018 om 3:25 PM schreef Reio Remma:
> Hello!
>
> I'm having crashes with LMTP delivery when user is over quota on the
> latest CentOS 7.4 with the latest Dovecot 2.3.0.1 from Dovecot repo.
>
> I see the issue has been fixed on January 17, but it doesn't seem to
> have made it into 2.3.0.1 (I compared with the source from
> https://dovecot.org/releases/2.3/dovecot-2.3.0.1.tar.gz).

That release is just about the CVEs afaik. The remaining fixes will be
in v2.3.1.

> https://github.com/dovecot/core/commit/2bf919786518d138cc07d9cc21e14ad5e07e5e56#diff-7964e00c46515956a959fa47fc86d605
>
> I also noticed a similar construct being used on line 465
> (rcpt->rcpt.rcpt->path) that was causing the segfault on the above
> commit on line 136.
>
> struct smtp_address *rcpt_to = rcpt->rcpt.rcpt->path;
>
> Should that also use rcpt->rcpt.path; ?

It would be a bit cleaner maybe, but at the DATA stage it will not
segfault anymore, since the recipient path is definitively put in the
transaction.

Regards,

Stephan.