From c88dd4f13931ac5f878a4e0d44ecb10be8e563be Mon Sep 17 00:00:00 2001
From: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date: Fri, 11 Jun 2021 17:36:34 +0100
Subject: [PATCH] [Fix] Fix check of limits in email address parsing

---
 src/libmime/email_addr.c | 48 ++++++++++++++++++++++++++--------------
 1 file changed, 31 insertions(+), 17 deletions(-)

diff --git a/src/libmime/email_addr.c b/src/libmime/email_addr.c
index 4b8c6bc1c..6895c1b11 100644
--- a/src/libmime/email_addr.c
+++ b/src/libmime/email_addr.c
@@ -199,7 +199,7 @@ rspamd_email_address_parse_heuristic (const char *data, size_t len,
 	return ret;
 }
 
-static inline gboolean
+static inline int
 rspamd_email_address_check_and_add (const gchar *start, gsize len,
 									GPtrArray *res,
 									rspamd_mempool_t *pool,
@@ -215,7 +215,7 @@ rspamd_email_address_check_and_add (const gchar *start, gsize len,
 				max_elements,
 				ns);
 
-		return FALSE;
+		return -1;
 	}
 
 	/* The whole email is likely address */
@@ -231,14 +231,14 @@ rspamd_email_address_check_and_add (const gchar *start, gsize len,
 				len, &addr)) {
 			rspamd_email_address_add (pool, res, &addr, ns);
 
-			return TRUE;
+			return 1;
 		}
 		else {
-			return FALSE;
+			return 0;
 		}
 	}
 
-	return TRUE;
+	return 1;
 }
 
 GPtrArray *
@@ -388,10 +388,16 @@ rspamd_email_address_from_mime (rspamd_mempool_t *pool, const gchar *hdr,
 						t --;
 					}
 
-					if (!rspamd_email_address_check_and_add (c, t - c + 1,
-							res, pool, ns, max_elements)) {
+					int check = rspamd_email_address_check_and_add (c, t - c + 1,
+							res, pool, ns, max_elements);
+
+					if (check == 0 && res->len == 0) {
+						/* Insert fake address */
 						rspamd_email_address_add (pool, res, NULL, ns);
 					}
+					else if (check != 1) {
+						goto end;
+					}
 
 					/* Cleanup for the next use */
 					g_string_set_size (ns, 0);
@@ -432,10 +438,15 @@ rspamd_email_address_from_mime (rspamd_mempool_t *pool, const gchar *hdr,
 			break;
 		case parse_addr:
 			if (*p == '>') {
-				if (!rspamd_email_address_check_and_add (c, p - c + 1,
-						res, pool, ns, max_elements)) {
+				int check = rspamd_email_address_check_and_add (c, p - c + 1,
+						res, pool, ns, max_elements);
+				if (check == 0 && res->len == 0) {
+					/* Insert a fake address */
 					rspamd_email_address_add (pool, res, NULL, ns);
 				}
+				else if (check != 1) {
+					goto end;
+				}
 
 				/* Cleanup for the next use */
 				g_string_set_size (ns, 0);
@@ -472,11 +483,14 @@ rspamd_email_address_from_mime (rspamd_mempool_t *pool, const gchar *hdr,
 			if (p > c) {
 				if (seen_at) {
 					/* The whole email is likely address */
-					if (!rspamd_email_address_check_and_add (c, p - c,
-							res, pool, ns, max_elements)) {
-						if (res->len == 0) {
-							rspamd_email_address_add (pool, res, NULL, ns);
-						}
+					int check = rspamd_email_address_check_and_add (c, p - c,
+							res, pool, ns, max_elements);
+					if (check == 0 && res->len == 0) {
+						/* Insert a fake address */
+						rspamd_email_address_add (pool, res, NULL, ns);
+					}
+					else if (check != 1) {
+						goto end;
 					}
 				} else {
 					/* No @ seen */
@@ -494,8 +508,8 @@ rspamd_email_address_from_mime (rspamd_mempool_t *pool, const gchar *hdr,
 		break;
 	case parse_addr:
 		if (p > c) {
-			if (!rspamd_email_address_check_and_add (c, p - c,
-					res, pool, ns, max_elements)) {
+			if (rspamd_email_address_check_and_add (c, p - c,
+					res, pool, ns, max_elements) == 0) {
 				if (res->len == 0) {
 					rspamd_email_address_add (pool, res, NULL, ns);
 				}
@@ -509,7 +523,7 @@ rspamd_email_address_from_mime (rspamd_mempool_t *pool, const gchar *hdr,
 		/* Do nothing */
 		break;
 	}
-
+end:
 	rspamd_mempool_notify_alloc (pool, cpy->len);
 	g_string_free (ns, TRUE);
 
-- 
2.39.5