From: David Levine <levinedl@acm.org>
Date: Wed, 18 Nov 2015 23:35:59 +0000 (-0500)
Subject: Remove any enclosing quotes from a timezone identifier in an
X-Git-Url: https://diplodocus.org/git/nmh/commitdiff_plain/68bb948f6c1484de72e07f315b9dd1694037acfd?ds=sidebyside;hp=33ee48487aba4989607d930e341032005de02004

Remove any enclosing quotes from a timezone identifier in an
iCalendar event request.  See comment added to format_datetime()
that says that I don't believe that RFC 5545 allows them to be
quoted.  But Oliver Kiddle found them in the wild.
---

diff --git a/sbr/datetime.c b/sbr/datetime.c
index 8b251362..34287b23 100644
--- a/sbr/datetime.c
+++ b/sbr/datetime.c
@@ -199,7 +199,11 @@ load_timezones (const contentline *clines) {
                 in_daylight = 1;
                 params = &timezone->daylight_params;
             } else if (! strcasecmp ("TZID", node->name)) {
-                timezone->tzid = strdup (node->value);
+                /* See comment below in format_datetime() about removing any enclosing quotes from a
+                   timezone identifier. */
+                char *buf = mh_xmalloc(strlen(node->value) + 1);
+                unquote_string(node->value, buf);
+                timezone->tzid = buf;
             }
         } else {
             if (! strcasecmp ("BEGIN", node->name)  &&
@@ -329,7 +333,15 @@ format_datetime (tzdesc_t timezones, const contentline *node) {
     /* Extract the timezone, if specified (RFC 5545 Sec. 3.3.5 Form #3). */
     for (p = node->params; p && p->param_name; p = p->next) {
         if (! strcasecmp (p->param_name, "TZID")  &&  p->values) {
-            dt_timezone = p->values->value;
+            /* Remove any enclosing quotes from the timezone identifier.  I don't believe that it's
+               legal for it to be quoted, according to RFC 5545 § 3.2.19:
+                   tzidparam  = "TZID" "=" [tzidprefix] paramtext
+                   tzidprefix = "/"
+               where paramtext includes SAFE-CHAR, which specifically excludes DQUOTE.  But we'll
+               be generous and strip quotes. */
+            char *buf = mh_xmalloc(strlen(p->values->value) + 1);
+            unquote_string(p->values->value, buf);
+            dt_timezone = buf;
             break;
         }
     }
@@ -360,8 +372,11 @@ format_datetime (tzdesc_t timezones, const contentline *node) {
         if (tz->tzid  &&  ! strcasecmp (dt_timezone, tz->tzid)) { break; }
     }
 
-    if (! tz) {
+    if (tz) {
+        free(dt_timezone);
+    } else {
         advise (NULL, "did not find VTIMEZONE section for %s", dt_timezone);
+        free(dt_timezone);
         return NULL;
     }
 
diff --git a/test/mhical/test-mhical b/test/mhical/test-mhical
index b1146cc1..d3900e05 100755
--- a/test/mhical/test-mhical
+++ b/test/mhical/test-mhical
@@ -739,4 +739,40 @@ check "$expected" "$MH_TEST_DIR/test1.txt"
 rm -f "$MH_TEST_DIR/test1.ics"
 
 
+# Check TZID name wrapped with quotes, this used to cause a segfault.
+cat >"$expected" <<'EOF'
+Method: REQUEST
+Summary: Quoted timezone ID
+At: Wed, 01 Jan 2014 00:00
+To: Wed, 01 Jan 2014 01:00
+EOF
+
+cat >"$MH_TEST_DIR/test1.ics" <<'EOF'
+BEGIN:VCALENDAR
+PRODID:Zimbra-Calendar-Provider
+VERSION:2.0
+METHOD:REQUEST
+SUMMARY:Quoted timezone ID
+BEGIN:VTIMEZONE
+TZID:Etc/GMT
+BEGIN:STANDARD
+DTSTART:19710101T000000
+TZOFFSETTO:-0000
+TZOFFSETFROM:-0000
+TZNAME:GMT
+END:STANDARD
+END:VTIMEZONE
+BEGIN:VEVENT
+DTSTART:20140101T000000
+DTEND;TZID="Etc/GMT":20140101T010000
+SEQUENCE:0
+END:VEVENT
+END:VCALENDAR
+EOF
+
+TZ=UTC mhical <"$MH_TEST_DIR/test1.ics" >"$MH_TEST_DIR/test1.txt"
+check "$expected" "$MH_TEST_DIR/test1.txt"
+rm -f "$MH_TEST_DIR/test1.ics"
+
+
 exit $failed