1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
|
CVE: CVE-2025-53859
Upstream-Status: Backport [https://nginx.org/download/patch.2025.smtp.txt]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
diff --git a/src/mail/ngx_mail_handler.c b/src/mail/ngx_mail_handler.c
index 1167df3fb..d3be7f3b3 100644
--- a/src/mail/ngx_mail_handler.c
+++ b/src/mail/ngx_mail_handler.c
@@ -523,7 +523,7 @@ ngx_mail_starttls_only(ngx_mail_session_t *s, ngx_connection_t *c)
ngx_int_t
ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n)
{
- u_char *p, *last;
+ u_char *p, *pos, *last;
ngx_str_t *arg, plain;
arg = s->args.elts;
@@ -555,7 +555,7 @@ ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n)
return NGX_MAIL_PARSE_INVALID_COMMAND;
}
- s->login.data = p;
+ pos = p;
while (p < last && *p) { p++; }
@@ -565,7 +565,8 @@ ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n)
return NGX_MAIL_PARSE_INVALID_COMMAND;
}
- s->login.len = p++ - s->login.data;
+ s->login.len = p++ - pos;
+ s->login.data = pos;
s->passwd.len = last - p;
s->passwd.data = p;
@@ -583,24 +584,26 @@ ngx_int_t
ngx_mail_auth_login_username(ngx_mail_session_t *s, ngx_connection_t *c,
ngx_uint_t n)
{
- ngx_str_t *arg;
+ ngx_str_t *arg, login;
arg = s->args.elts;
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
"mail auth login username: \"%V\"", &arg[n]);
- s->login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[n].len));
- if (s->login.data == NULL) {
+ login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[n].len));
+ if (login.data == NULL) {
return NGX_ERROR;
}
- if (ngx_decode_base64(&s->login, &arg[n]) != NGX_OK) {
+ if (ngx_decode_base64(&login, &arg[n]) != NGX_OK) {
ngx_log_error(NGX_LOG_INFO, c->log, 0,
"client sent invalid base64 encoding in AUTH LOGIN command");
return NGX_MAIL_PARSE_INVALID_COMMAND;
}
+ s->login = login;
+
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
"mail auth login username: \"%V\"", &s->login);
@@ -611,7 +614,7 @@ ngx_mail_auth_login_username(ngx_mail_session_t *s, ngx_connection_t *c,
ngx_int_t
ngx_mail_auth_login_password(ngx_mail_session_t *s, ngx_connection_t *c)
{
- ngx_str_t *arg;
+ ngx_str_t *arg, passwd;
arg = s->args.elts;
@@ -620,18 +623,19 @@ ngx_mail_auth_login_password(ngx_mail_session_t *s, ngx_connection_t *c)
"mail auth login password: \"%V\"", &arg[0]);
#endif
- s->passwd.data = ngx_pnalloc(c->pool,
- ngx_base64_decoded_length(arg[0].len));
- if (s->passwd.data == NULL) {
+ passwd.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len));
+ if (passwd.data == NULL) {
return NGX_ERROR;
}
- if (ngx_decode_base64(&s->passwd, &arg[0]) != NGX_OK) {
+ if (ngx_decode_base64(&passwd, &arg[0]) != NGX_OK) {
ngx_log_error(NGX_LOG_INFO, c->log, 0,
"client sent invalid base64 encoding in AUTH LOGIN command");
return NGX_MAIL_PARSE_INVALID_COMMAND;
}
+ s->passwd = passwd;
+
#if (NGX_DEBUG_MAIL_PASSWD)
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
"mail auth login password: \"%V\"", &s->passwd);
@@ -674,24 +678,26 @@ ngx_int_t
ngx_mail_auth_cram_md5(ngx_mail_session_t *s, ngx_connection_t *c)
{
u_char *p, *last;
- ngx_str_t *arg;
+ ngx_str_t *arg, login;
arg = s->args.elts;
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
"mail auth cram-md5: \"%V\"", &arg[0]);
- s->login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len));
- if (s->login.data == NULL) {
+ login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len));
+ if (login.data == NULL) {
return NGX_ERROR;
}
- if (ngx_decode_base64(&s->login, &arg[0]) != NGX_OK) {
+ if (ngx_decode_base64(&login, &arg[0]) != NGX_OK) {
ngx_log_error(NGX_LOG_INFO, c->log, 0,
"client sent invalid base64 encoding in AUTH CRAM-MD5 command");
return NGX_MAIL_PARSE_INVALID_COMMAND;
}
+ s->login = login;
+
p = s->login.data;
last = p + s->login.len;
|
