smtp: Check payload length during parsing.

Author: Pavel Siska

process/smtp.cpp

@@ -45,6 +45,7 @@
 #include <cstring>
 #include <ctype.h>
 
+#include "common.hpp"
 #include "smtp.hpp"
 
 namespace ipxp {
@@ -273,6 +274,7 @@ bool SMTPPlugin::parse_smtp_command(const char *data, int payload_len, RecordExt
    const char *begin, *end;
    char buffer[32];
    size_t len;
+   size_t remaining;
 
    if (payload_len == 0) {
       return false;
@@ -287,13 +289,13 @@ bool SMTPPlugin::parse_smtp_command(const char *data, int payload_len, RecordExt
    }
 
    begin = data;
-   end = strchr(begin, '\r');
+   end = static_cast<const char *>(memchr(begin, '\r', payload_len));
 
    len = end - begin;
    if (end == nullptr) {
       return false;
    }
-   end = strchr(begin, ' ');
+   end = static_cast<const char *>(memchr(begin, ' ', payload_len));
    if (end != nullptr) {
       len = end - begin;
    }
@@ -307,7 +309,8 @@ bool SMTPPlugin::parse_smtp_command(const char *data, int payload_len, RecordExt
    if (!strcmp(buffer, "HELO") || !strcmp(buffer, "EHLO")) {
       if (rec->domain[0] == 0 && end != nullptr) {
          begin = end;
-         end = strchr(begin, '\r');
+         remaining = payload_len - (begin - data);
+         end = static_cast<const char *>(memchr(begin, '\r', remaining));
          if (end != nullptr && begin != NULL) {
             begin++;
             len = end - begin;
@@ -327,8 +330,14 @@ bool SMTPPlugin::parse_smtp_command(const char *data, int payload_len, RecordExt
    } else if (!strcmp(buffer, "RCPT")) {
       rec->mail_rcpt_cnt++;
       if (rec->first_recipient[0] == 0 && end != nullptr) {
-         begin = strchr(end + 1, ':');
-         end = strchr(end, '\r');
+         if (check_payload_len(payload_len, (end + 1) - data)) {
+            return false;
+         }
+         remaining = payload_len - ((end + 1) - data);
+         begin = static_cast<const char *>(memchr(end + 1, ':', remaining));
+         remaining = payload_len - (end - data);
+         end = static_cast<const char *>(memchr(end, '\r', remaining));
+
          if (end != nullptr && begin != NULL) {
             begin++;
             len = end - begin;
@@ -344,8 +353,14 @@ bool SMTPPlugin::parse_smtp_command(const char *data, int payload_len, RecordExt
    } else if (!strcmp(buffer, "MAIL")) {
       rec->mail_cmd_cnt++;
       if (rec->first_sender[0] == 0 && end != nullptr) {
-         begin = strchr(end + 1, ':');
-         end = strchr(end, '\r');
+         if (check_payload_len(payload_len, (end + 1) - data)) {
+            return false;
+         }
+         remaining = payload_len - ((end + 1) - data);
+         begin = static_cast<const char *>(memchr(end + 1, ':', remaining));
+         remaining = payload_len - (end - data);
+         end = static_cast<const char *>(memchr(end, '\r', remaining));
+
          if (end != nullptr && begin != NULL) {
             begin++;
             len = end - begin;