pop3: Fixed selection of APOP when server replies with an invalid timestamp

Although highlighted by a bug in commit 1cfb436a2f1795, APOP
authentication could be chosen if the server was to reply with an empty
or missing timestamp in the server greeting and APOP was given in the
capability list by the server.

diff --git a/lib/pop3.c b/lib/pop3.c
index 093b77e93d0a1a57ea2197b1092f79105da97a31..eb0164862df91baf152212c5d2e36252c162dc48 100644 (file)
--- a/lib/pop3.c
+++ b/lib/pop3.c
@@ -561,7 +561,8 @@ static CURLcode pop3_perform_authentication(struct connectdata *conn)
     }
 #ifndef CURL_DISABLE_CRYPTO_AUTH
     else if((pop3c->authtypes & POP3_TYPE_APOP) &&
-            (pop3c->preftype & POP3_TYPE_APOP))
+            (pop3c->preftype & POP3_TYPE_APOP) &&
+            (pop3c->apoptimestamp))
       /* Perform APOP authentication */
       result = pop3_perform_apop(conn);
 #endif
@@ -663,6 +664,8 @@ static CURLcode pop3_state_servergreet_resp(struct connectdata *conn,
         if(line[i] == '<') {
           /* Calculate the length of the timestamp */
           size_t timestamplen = len - 2 - i;
+          if(!timestamplen)
+            break;
 
           /* Allocate some memory for the timestamp */
           pop3c->apoptimestamp = (char *)calloc(1, timestamplen + 1);
@@ -1198,7 +1201,8 @@ static CURLcode pop3_state_auth_cancel_resp(struct connectdata *conn,
     }
 #ifndef CURL_DISABLE_CRYPTO_AUTH
     else if((pop3c->authtypes & POP3_TYPE_APOP) &&
-            (pop3c->preftype & POP3_TYPE_APOP))
+            (pop3c->preftype & POP3_TYPE_APOP) &&
+            (pop3c->apoptimestamp))
       /* Perform APOP authentication */
       result = pop3_perform_apop(conn);
 #endif