From 3209fc32dd273d5a3e886e334108e82b33ebed2a Mon Sep 17 00:00:00 2001
From: Mario Fetka <mario.fetka@gmail.com>
Date: Tue, 28 Jul 2026 07:18:50 +0200
Subject: [PATCH] smtp: reject an empty recipient path

---
 src/agents/smtp/protocol.c            | 6 ++++++
 src/agents/smtp/protocol.h            | 1 +
 src/agents/smtp/smtpd.c               | 6 ++++++
 src/agents/smtp/tests/protocol-test.c | 5 +++++
 4 files changed, 18 insertions(+)

diff --git a/src/agents/smtp/protocol.c b/src/agents/smtp/protocol.c
index 5a27ca6..5e535d4 100644
--- a/src/agents/smtp/protocol.c
+++ b/src/agents/smtp/protocol.c
@@ -230,6 +230,12 @@ SMTPPathIsSafe(const char *path)
     return 1;
 }
 
+int
+SMTPRecipientPathIsValid(const char *path)
+{
+    return path != NULL && path[0] != '\0' && SMTPPathIsSafe(path);
+}
+
 static int
 HexValue(unsigned char value)
 {
diff --git a/src/agents/smtp/protocol.h b/src/agents/smtp/protocol.h
index cb1030a..1083d6b 100644
--- a/src/agents/smtp/protocol.h
+++ b/src/agents/smtp/protocol.h
@@ -103,6 +103,7 @@ int SMTPParseBdatArguments(const char *arguments, uint64_t *chunk_size,
 int SMTPParseVerifyArguments(const char *arguments, char *query,
                              size_t query_size, int *smtp_utf8);
 int SMTPPathIsSafe(const char *path);
+int SMTPRecipientPathIsValid(const char *path);
 int SMTPXtextEncode(const char *value, char *encoded, size_t encoded_size);
 int SMTPXtextDecode(const char *encoded, char *value, size_t value_size);
 int SMTPFormatOrcptValue(const char *original, int smtp_utf8,
diff --git a/src/agents/smtp/smtpd.c b/src/agents/smtp/smtpd.c
index 40b8672..cf055ea 100644
--- a/src/agents/smtp/smtpd.c
+++ b/src/agents/smtp/smtpd.c
@@ -1446,6 +1446,12 @@ HandleConnection (void *param)
                         } while (isspace (*ptr2));
                     }
 
+                    if (!SMTPRecipientPathIsValid(name)) {
+                        ConnWrite(Client->client.conn, MSG501RECIPNO,
+                                  MSG501RECIPNO_LEN);
+                        goto QuitRcpt;
+                    }
+
                     ParameterResult = SMTPParseRcptParameters(
                         ptr2,
                         (Client->MsgFlags & MSG_FLAG_SMTPUTF8) != 0,
diff --git a/src/agents/smtp/tests/protocol-test.c b/src/agents/smtp/tests/protocol-test.c
index b9f9d1b..1160d82 100644
--- a/src/agents/smtp/tests/protocol-test.c
+++ b/src/agents/smtp/tests/protocol-test.c
@@ -142,6 +142,11 @@ TestPaths(void)
     assert(!SMTPPathIsSafe("user@example.test\r\nRCPT TO:<victim>"));
     assert(!SMTPPathIsSafe("user> SIZE=0"));
     assert(!SMTPPathIsSafe("bad\177@example.test"));
+    assert(SMTPRecipientPathIsValid("user@example.test"));
+    assert(SMTPRecipientPathIsValid("m\303\274ller@example.test"));
+    assert(!SMTPRecipientPathIsValid(NULL));
+    assert(!SMTPRecipientPathIsValid(""));
+    assert(!SMTPRecipientPathIsValid("user name@example.test"));
 }
 
 static void