flashmob / go-guerrilla

Mini SMTP server written in golang
MIT License
2.76k stars 361 forks source link

Runtime error: index out of range #225

Open 4k7 opened 3 years ago

4k7 commented 3 years ago

Hi,

In some cases , the "pos" value in RFC5322 class (mail/rfc5321/address.go) becomes -2, that leads to an runtime error (index out of range) in the functions peek() & next() in Parser class (mail/rfc5321/parse.go).

It happens here, if pos = -1.

s.pos = pos - 1 //- 1 // rewind to the saved position

This is line from this function (mail/rfc5321/address.go).

// mailbox  =   name-addr / addr-spec
func (s *RFC5322) mailbox() error {
    pos := s.pos // save the position
    if err := s.nameAddr(); err != nil {
        if err == errExpectingAngleAddress && s.ch != ':' { // ':' means it's a group
            // we'll attempt to parse as an email address without angle brackets
            s.addr.DisplayName = ""
            s.addr.DisplayNameQuoted = false
            s.pos = pos - 1 //- 1 // rewind to the saved position
            if s.pos > -1 {
                s.ch = s.buf[s.pos]
            }
            if err = s.Parser.mailbox(); err != nil {
                return err
            }
            s.addAddress()
        } else {
            return err
        }
    }
    return nil
}

Thanks!

flashmob commented 3 years ago

got some sample input?

On Tue, 16 Feb 2021 at 03:18, int01 notifications@github.com wrote:

Hi,

In some cases , the "pos" value in RFC5322 class (mail/rfc5321/address.go) becomes -2, that leads to an runtime error (index out of range) in the functions peek() & next() in Parser class (mail/rfc5321/parse.go).

It happens here, if pos = -1.

s.pos = pos - 1 //- 1 // rewind to the saved position

This is line from this function (mail/rfc5321/address.go).

// mailbox = name-addr / addr-spec func (s *RFC5322) mailbox() error { pos := s.pos // save the position if err := s.nameAddr(); err != nil { if err == errExpectingAngleAddress && s.ch != ':' { // ':' means it's a group // we'll attempt to parse as an email address without angle brackets s.addr.DisplayName = "" s.addr.DisplayNameQuoted = false s.pos = pos - 1 //- 1 // rewind to the saved position if s.pos > -1 { s.ch = s.buf[s.pos] } if err = s.Parser.mailbox(); err != nil { return err } s.addAddress() } else { return err } } return nil }

Thanks!

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/flashmob/go-guerrilla/issues/225, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAE6MP5MT3Y6HVOPWPAIE4DS7FQPZANCNFSM4XVDVO2Q .

4k7 commented 3 years ago

There are no sample input, but after this fix, the error no longer appears.