From d53d83214b1d635446a8cf8ff9438cc530133d62 Mon Sep 17 00:00:00 2001 From: Timo Sirainen Date: Thu, 23 Apr 2020 15:00:57 +0300 Subject: [PATCH 09/13] lib-mail: message-parser - Don't use memory pool for parser This reduces memory usage when parsing many MIME parts where boundaries are being added and removed constantly. --- src/lib-mail/message-parser.c | 48 ++++++++++++++++++++++++++++--------------- 1 file changed, 32 insertions(+), 16 deletions(-) Signed-off-by: Sana Kazi CVE: CVE-2020-12100 Upstream-Status: Backport [http://archive.ubuntu.com/ubuntu/pool/main/d/dovecot/dovecot_2.2.33.2-1ubuntu4.7.debian.tar.xz] Comment: No change in any hunk diff --git a/src/lib-mail/message-parser.c b/src/lib-mail/message-parser.c index 028f74159..8970d8e0e 100644 --- a/src/lib-mail/message-parser.c +++ b/src/lib-mail/message-parser.c @@ -17,14 +17,14 @@ struct message_boundary { struct message_boundary *next; struct message_part *part; - const char *boundary; + char *boundary; size_t len; unsigned int epilogue_found:1; }; struct message_parser_ctx { - pool_t parser_pool, part_pool; + pool_t part_pool; struct istream *input; struct message_part *parts, *part; const char *broken_reason; @@ -32,7 +32,7 @@ struct message_parser_ctx { enum message_header_parser_flags hdr_flags; enum message_parser_flags flags; - const char *last_boundary; + char *last_boundary; struct message_boundary *boundaries; struct message_part **next_part; @@ -223,10 +223,24 @@ static void message_part_finish(struct message_parser_ctx *ctx) ctx->part = ctx->part->parent; } +static void message_boundary_free(struct message_boundary *b) +{ + i_free(b->boundary); + i_free(b); +} + static void boundary_remove_until(struct message_parser_ctx *ctx, struct message_boundary *boundary) { + while (ctx->boundaries != boundary) { + struct message_boundary *cur = ctx->boundaries; + + i_assert(cur != NULL); + ctx->boundaries = cur->next; + message_boundary_free(cur); + + } ctx->boundaries = boundary; } @@ -234,15 +248,14 @@ static void parse_next_body_multipart_init(struct message_parser_ctx *ctx) { struct message_boundary *b; - b = p_new(ctx->parser_pool, struct message_boundary, 1); + b = i_new(struct message_boundary, 1); b->part = ctx->part; b->boundary = ctx->last_boundary; + ctx->last_boundary = NULL; b->len = strlen(b->boundary); b->next = ctx->boundaries; ctx->boundaries = b; - - ctx->last_boundary = NULL; } static int parse_next_body_message_rfc822_init(struct message_parser_ctx *ctx, @@ -359,6 +372,8 @@ static int parse_part_finish(struct message_parser_ctx *ctx, struct message_block *block_r, bool first_line) { size_t line_size; + size_t boundary_len = boundary->len; + bool boundary_epilogue_found = boundary->epilogue_found; i_assert(ctx->last_boundary == NULL); @@ -391,7 +406,7 @@ static int parse_part_finish(struct message_parser_ctx *ctx, i_assert(block_r->data[0] == '\n'); line_size = 1; } - line_size += 2 + boundary->len + (boundary->epilogue_found ? 2 : 0); + line_size += 2 + boundary_len + (boundary_epilogue_found ? 2 : 0); i_assert(block_r->size >= ctx->skip + line_size); block_r->size = line_size; parse_body_add_block(ctx, block_r); @@ -553,9 +568,9 @@ static void parse_content_type(struct message_parser_ctx *ctx, for (; *results != NULL; results += 2) { if (strcasecmp(results[0], "boundary") == 0) { /* truncate excessively long boundaries */ + i_free(ctx->last_boundary); ctx->last_boundary = - p_strndup(ctx->parser_pool, results[1], - BOUNDARY_STRING_MAX_LEN); + i_strndup(results[1], BOUNDARY_STRING_MAX_LEN); break; } } @@ -678,7 +693,7 @@ static int parse_next_header(struct message_parser_ctx *ctx, i_assert(!ctx->multipart); part->flags = 0; } - ctx->last_boundary = NULL; + i_free(ctx->last_boundary); if (!ctx->part_seen_content_type || (part->flags & MESSAGE_PART_FLAG_IS_MIME) == 0) { @@ -1081,11 +1096,8 @@ message_parser_init_int(struct istream *input, enum message_parser_flags flags) { struct message_parser_ctx *ctx; - pool_t pool; - pool = pool_alloconly_create("Message Parser", 1024); - ctx = p_new(pool, struct message_parser_ctx, 1); - ctx->parser_pool = pool; + ctx = i_new(struct message_parser_ctx, 1); ctx->hdr_flags = hdr_flags; ctx->flags = flags; ctx->input = input; @@ -1105,7 +1117,7 @@ message_parser_init(pool_t part_pool, struct istream *input, ctx->parts = ctx->part = p_new(part_pool, struct message_part, 1); ctx->next_part = &ctx->part->children; ctx->parse_next_block = parse_next_header_init; - p_array_init(&ctx->next_part_stack, ctx->parser_pool, 4); + i_array_init(&ctx->next_part_stack, 4); return ctx; } @@ -1146,8 +1158,12 @@ int message_parser_deinit_from_parts(struct message_parser_ctx **_ctx, if (ctx->hdr_parser_ctx != NULL) message_parse_header_deinit(&ctx->hdr_parser_ctx); + boundary_remove_until(ctx, NULL); i_stream_unref(&ctx->input); - pool_unref(&ctx->parser_pool); + if (array_is_created(&ctx->next_part_stack)) + array_free(&ctx->next_part_stack); + i_free(ctx->last_boundary); + i_free(ctx); i_assert(ret < 0 || *parts_r != NULL); return ret; } -- 2.11.0