Mitigate buffer overflow in SMTP: Ensure username_size < sizeof username before memcpy

[DaBigBlob]

Trivial fix but mitigates a potentially nasty memory bug (buffer overflow) in the SMTP server.

Diff

@@ -549,6 +549,7 @@ static void handle_auth(enum state *state)
 		if(user_end == NULL)
 			REPLY("535 Authentication credentials invalid")
 		username_size = (size_t)(user_end - user_start);
+		if (username_size > sizeof username) REPLY("535 Username too long");
 		memcpy(username, user_start, username_size);
 		if(!validate_and_case_fold_email_address(username_size, username))
 			REPLY("535 Invalid username")

Explanation

• line_buff is 1024 chars and username is 256 chars.
• by the time execution reaches memchr in the AUTH PLAIN branch, line_size isn't necessarily small enough to ensure that username_size computes to <= 256.
• this allows for user input to (using SMPT command AUTH PLAIN) to write arbitrary ~1k data starting from pointer username.

PoC

printf 'EHLO kdlp\r\nAUTH PLAIN %s\r\nQUIT\r\n' $(python3 -c 'import base64; print(base64.b64encode(b"\x00" + b"a"*500 + b"\x00" + b"p"*5).decode())') | ./smtp dir_mail dir_log dir_patchset

[charliemirabile]

I guess I should have said to use the more specific verb "fixup" instead of "squash", but in either case I do not need three commit messages and three signed off by lines. You can delete everything below the first DCO with a git commit --amend and then force push

[charliemirabile]

LGTM