From 9d0ed39a1458e1ee467e83ca3b681d64c4bc0816 Mon Sep 17 00:00:00 2001 From: Luigi Colluto Date: Sun, 5 Jul 2026 19:57:18 +0200 Subject: [PATCH] fix: avoid panic on a multi-byte UTF-8 SMTP reply line --- src/plugins/smtp/ntlm.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/plugins/smtp/ntlm.rs b/src/plugins/smtp/ntlm.rs index a1cc7b1..9639591 100644 --- a/src/plugins/smtp/ntlm.rs +++ b/src/plugins/smtp/ntlm.rs @@ -40,7 +40,12 @@ async fn read_reply(channel: &mut Channel) -> Result<(u16, String), Error> { if trimmed.len() < 3 { return Err(format!("smtp: malformed reply line {:?}", trimmed)); } - let code: u16 = trimmed[..3] + // trimmed.len() >= 3 is a BYTE length, but trimmed[..3] is a byte-index slice that + // panics if byte 3 is not a UTF-8 char boundary (a multi-byte reply line from a + // malicious server). Use get(..3) so a bad boundary is a returned error, not a panic. + let code: u16 = trimmed + .get(..3) + .ok_or_else(|| format!("smtp: malformed reply line {:?}", trimmed))? .parse() .map_err(|e: std::num::ParseIntError| format!("smtp: bad reply code: {}", e))?; // RFC 5321 ยง4.2: a continuation line uses '-' as the fourth char, the