From ca02a1020c41cc771d4ed6f854213edf594b4480 Mon Sep 17 00:00:00 2001 From: Maxim Dounin Date: Wed, 21 May 2014 21:56:20 +0400 Subject: [PATCH] Mail: added a check for the number of arguments in MAIL/RCPT. Missed during introduction of the SMTP pipelining support (04e43d03e153, 1.5.6). Previously, the check wasn't needed as s->buffer was used directly and the number of arguments didn't matter. Reported by Svyatoslav Nikolsky. --- src/mail/ngx_mail_smtp_handler.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/mail/ngx_mail_smtp_handler.c b/src/mail/ngx_mail_smtp_handler.c index 52fe47523..665f5ef19 100644 --- a/src/mail/ngx_mail_smtp_handler.c +++ b/src/mail/ngx_mail_smtp_handler.c @@ -679,6 +679,11 @@ ngx_mail_smtp_mail(ngx_mail_session_t *s, ngx_connection_t *c) return NGX_OK; } + if (s->args.nelts == 0) { + ngx_str_set(&s->out, smtp_invalid_argument); + return NGX_OK; + } + arg = s->args.elts; arg += s->args.nelts - 1; @@ -713,6 +718,11 @@ ngx_mail_smtp_rcpt(ngx_mail_session_t *s, ngx_connection_t *c) return NGX_OK; } + if (s->args.nelts == 0) { + ngx_str_set(&s->out, smtp_invalid_argument); + return NGX_OK; + } + arg = s->args.elts; arg += s->args.nelts - 1;