File 0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch of Package dovecot23.15100

From 92d9690da195b6ceaa878ab1df6c7c31a75f63f8 Mon Sep 17 00:00:00 2001
From: Stephan Bosch <stephan.bosch@open-xchange.com>
Date: Fri, 20 Mar 2020 13:38:41 +0100
Subject: [PATCH 16/16] lmtp: lmtp-commands - Explicity prohibit empty RCPT
 path.

The empty path <""> will yield an empty username.
---
 src/lmtp/lmtp-commands.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/lmtp/lmtp-commands.c b/src/lmtp/lmtp-commands.c
index c4d5989825..c368d6b668 100644
--- a/src/lmtp/lmtp-commands.c
+++ b/src/lmtp/lmtp-commands.c
@@ -66,10 +66,18 @@ int client_default_cmd_rcpt(struct client *client,
 	char delim = '\0';
 	int ret;
 
+	i_assert(!smtp_address_isnull(rcpt->path));
+	if (*rcpt->path->localpart == '\0' && rcpt->path->domain == NULL) {
+		smtp_server_recipient_reply(
+			rcpt, 550, "5.1.1",
+			"Unacceptable TO: Empty path not allowed");
+		return -1;
+	}
 
 	smtp_address_detail_parse_temp(
 		client->unexpanded_lda_set->recipient_delimiter,
 		rcpt->path, &username, &delim, &detail);
+	i_assert(*username != '\0');
 
 	/* Make user name and detail available in the recipient event. The
 	   mail_user event (for local delivery) also adds the user field, but
-- 
2.11.0