smtp: reject an empty recipient path

src/agents/smtp/protocol.c

@@ -230,6 +230,12 @@ SMTPPathIsSafe(const char *path)
     return 1;
 }
 
+int
+SMTPRecipientPathIsValid(const char *path)
+{
+    return path != NULL && path[0] != '\0' && SMTPPathIsSafe(path);
+}
+
 static int
 HexValue(unsigned char value)
 {

src/agents/smtp/protocol.h

@@ -103,6 +103,7 @@ int SMTPParseBdatArguments(const char *arguments, uint64_t *chunk_size,
 int SMTPParseVerifyArguments(const char *arguments, char *query,
                              size_t query_size, int *smtp_utf8);
 int SMTPPathIsSafe(const char *path);
+int SMTPRecipientPathIsValid(const char *path);
 int SMTPXtextEncode(const char *value, char *encoded, size_t encoded_size);
 int SMTPXtextDecode(const char *encoded, char *value, size_t value_size);
 int SMTPFormatOrcptValue(const char *original, int smtp_utf8,

src/agents/smtp/smtpd.c

@@ -1446,6 +1446,12 @@ HandleConnection (void *param)
                         } while (isspace (*ptr2));
                     }
 
+                    if (!SMTPRecipientPathIsValid(name)) {
+                        ConnWrite(Client->client.conn, MSG501RECIPNO,
+                                  MSG501RECIPNO_LEN);
+                        goto QuitRcpt;
+                    }
+
                     ParameterResult = SMTPParseRcptParameters(
                         ptr2,
                         (Client->MsgFlags & MSG_FLAG_SMTPUTF8) != 0,

src/agents/smtp/tests/protocol-test.c

@@ -142,6 +142,11 @@ TestPaths(void)
     assert(!SMTPPathIsSafe("user@example.test\r\nRCPT TO:<victim>"));
     assert(!SMTPPathIsSafe("user> SIZE=0"));
     assert(!SMTPPathIsSafe("bad\177@example.test"));
+    assert(SMTPRecipientPathIsValid("user@example.test"));
+    assert(SMTPRecipientPathIsValid("m\303\274ller@example.test"));
+    assert(!SMTPRecipientPathIsValid(NULL));
+    assert(!SMTPRecipientPathIsValid(""));
+    assert(!SMTPRecipientPathIsValid("user name@example.test"));
 }
 
 static void