aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSteve Holme <steve_holme@hotmail.com>2013-12-20 12:46:18 +0000
committerSteve Holme <steve_holme@hotmail.com>2013-12-20 14:51:45 +0000
commit9f260b5d6610f3845e811146e4197700a6cc7b6b (patch)
tree42065037227dd6686b98e240116761022925db38
parent045297671100a1361e0fb99f4a71a2cc696382b0 (diff)
pop3: Fixed selection of APOP when server replies with an invalid timestamp
Although highlighted by a bug in commit 1cfb436a2f1795, APOP authentication could be chosen if the server was to reply with an empty or missing timestamp in the server greeting and APOP was given in the capability list by the server.
-rw-r--r--lib/pop3.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/lib/pop3.c b/lib/pop3.c
index 093b77e93..eb0164862 100644
--- a/lib/pop3.c
+++ b/lib/pop3.c
@@ -561,7 +561,8 @@ static CURLcode pop3_perform_authentication(struct connectdata *conn)
}
#ifndef CURL_DISABLE_CRYPTO_AUTH
else if((pop3c->authtypes & POP3_TYPE_APOP) &&
- (pop3c->preftype & POP3_TYPE_APOP))
+ (pop3c->preftype & POP3_TYPE_APOP) &&
+ (pop3c->apoptimestamp))
/* Perform APOP authentication */
result = pop3_perform_apop(conn);
#endif
@@ -663,6 +664,8 @@ static CURLcode pop3_state_servergreet_resp(struct connectdata *conn,
if(line[i] == '<') {
/* Calculate the length of the timestamp */
size_t timestamplen = len - 2 - i;
+ if(!timestamplen)
+ break;
/* Allocate some memory for the timestamp */
pop3c->apoptimestamp = (char *)calloc(1, timestamplen + 1);
@@ -1198,7 +1201,8 @@ static CURLcode pop3_state_auth_cancel_resp(struct connectdata *conn,
}
#ifndef CURL_DISABLE_CRYPTO_AUTH
else if((pop3c->authtypes & POP3_TYPE_APOP) &&
- (pop3c->preftype & POP3_TYPE_APOP))
+ (pop3c->preftype & POP3_TYPE_APOP) &&
+ (pop3c->apoptimestamp))
/* Perform APOP authentication */
result = pop3_perform_apop(conn);
#endif