Null-terminate buffer in mbx_copy() in dropsbr.c. Noticed by

[nmh] / mts / smtp / smtp.c

diff --git a/mts/smtp/smtp.c b/mts/smtp/smtp.c
index c973c9191500d417c425aa9f4f0660f273de1445..7177e5d59ea330f086a2323f4576dcbb0042980f 100644 (file)
--- a/mts/smtp/smtp.c
+++ b/mts/smtp/smtp.c
@@ -9,7 +9,6 @@
 #include <h/mh.h>
 #include "smtp.h"
 #include <h/mts.h>
-#include <signal.h>
 #include <h/signals.h>
 
 #ifdef CYRUS_SASL
@@ -26,7 +25,6 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <netdb.h>
-#include <errno.h>
 #endif /* CYRUS_SASL */
 
 #ifdef TLS_SUPPORT
@@ -99,7 +97,7 @@ static FILE *sm_wfp = NULL;
 static sasl_conn_t *conn = NULL;       /* SASL connection state */
 static int sasl_complete = 0;          /* Has authentication succeded? */
 static sasl_ssf_t sasl_ssf;            /* Our security strength factor */
-static char *sasl_pw_context[2];       /* Context to pass into sm_get_pass */
+static char *sasl_pw_context[3];       /* Context to pass into sm_get_pass */
 static int maxoutbuf;                  /* Maximum crypto output buffer */
 static char *sasl_outbuffer;           /* SASL output buffer for encryption */
 static int sasl_outbuflen;             /* Current length of data in outbuf */
@@ -109,10 +107,10 @@ static int sm_get_pass(sasl_conn_t *, void *, int, sasl_secret_t **);
 static sasl_callback_t callbacks[] = {
     { SASL_CB_USER, (sasl_callback_ft) sm_get_user, NULL },
 #define SM_SASL_N_CB_USER 0
-    { SASL_CB_PASS, (sasl_callback_ft) sm_get_pass, NULL },
-#define SM_SASL_N_CB_PASS 1
     { SASL_CB_AUTHNAME, (sasl_callback_ft) sm_get_user, NULL },
-#define SM_SASL_N_CB_AUTHNAME 2
+#define SM_SASL_N_CB_AUTHNAME 1
+    { SASL_CB_PASS, (sasl_callback_ft) sm_get_pass, NULL },
+#define SM_SASL_N_CB_PASS 2
     { SASL_CB_LIST_END, NULL, NULL },
 };
 
@@ -820,17 +818,12 @@ sm_auth_sasl(char *user, int saslssf, char *mechlist, char *inhost)
     sasl_security_properties_t secprops;
     sasl_ssf_t *ssf;
     int *outbufmax;
+    struct nmh_creds creds = { 0, 0, 0 };
 
     /*
      * Initialize the callback contexts
      */
 
-    if (user == NULL)
-       user = getusername();
-
-    callbacks[SM_SASL_N_CB_USER].context = user;
-    callbacks[SM_SASL_N_CB_AUTHNAME].context = user;
-
     /*
      * This is a _bit_ of a hack ... but if the hostname wasn't supplied
      * to us on the command line, then call getpeername and do a
@@ -861,8 +854,15 @@ sm_auth_sasl(char *user, int saslssf, char *mechlist, char *inhost)
        strncpy(host, inhost, sizeof(host) - 1);
     }
 
+    nmh_get_credentials (host, user, 0, &creds);
+
+    /* It's OK to copy the creds pointers here.  The callbacks that
+       use them will only be called before this function returns. */
+    callbacks[SM_SASL_N_CB_USER].context = creds.user;
+    callbacks[SM_SASL_N_CB_AUTHNAME].context = creds.user;
     sasl_pw_context[0] = host;
-    sasl_pw_context[1] = user;
+    sasl_pw_context[1] = creds.user;
+    sasl_pw_context[2] = creds.password;
 
     callbacks[SM_SASL_N_CB_PASS].context = sasl_pw_context;
 
@@ -963,7 +963,6 @@ sm_auth_sasl(char *user, int saslssf, char *mechlist, char *inhost)
        } else {
            result = sasl_decode64(sm_reply.text, sm_reply.length,
                                   outbuf, sizeof(outbuf), &outlen);
-       
            if (result != SASL_OK) {
                smtalk(SM_AUTH, "*");
                sm_ierror("SASL base64 decode failed: %s",
@@ -1072,7 +1071,6 @@ sm_get_pass(sasl_conn_t *conn, void *context, int id,
            sasl_secret_t **psecret)
 {
     char **pw_context = (char **) context;
-    char *pass = NULL;
     int len;
 
     NMH_UNUSED (conn);
@@ -1080,20 +1078,14 @@ sm_get_pass(sasl_conn_t *conn, void *context, int id,
     if (! psecret || id != SASL_CB_PASS)
        return SASL_BADPARAM;
 
-    ruserpass(pw_context[0], &(pw_context[1]), &pass);
-
-    len = strlen(pass);
-
-    *psecret = (sasl_secret_t *) malloc(sizeof(sasl_secret_t) + len);
+    len = strlen (pw_context[2]);
 
-    if (! *psecret) {
-       free(pass);
+    if (! (*psecret = (sasl_secret_t *) malloc(sizeof(sasl_secret_t) + len))) {
        return SASL_NOMEM;
     }
 
     (*psecret)->len = len;
-    strcpy((char *) (*psecret)->data, pass);
-/*    free(pass); */
+    strcpy((char *) (*psecret)->data, pw_context[2]);
 
     return SASL_OK;
 }