#168 EnablePlusedDetail corrupts username when receiving via LMTP

[Dave Dribin]

When using EnablePlusedDetail with LMTP, the username is getting corrupted.

Example from LMTP:

RCPT TO:dave+foo.bar@mail.example.com

From the debug log:

31191: [08/17/2013 00:48:30] processing user dave@maie.coample.com

"dave+foo.bar@mail.example.com" is corrupted to "dave@maie.coample.com", instead of "dave@mail.example.com".

I can repro on Ubunutu 12.04 with the standard dspam version (3.10.1).

% nc -U /var/spool/postfix/var/run/dspam/dspam.sock < ~/lmtp-test.txt

Attaching lmtp-test.txt.

Running with valgrind found the problem:

==31967== Thread 2:
==31967== Source and destination overlap in strcpy(0x8880f6c, 0x8880f74)
==31967== at 0x48D373B: strcpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==31967== by 0x8053D29: process_users (in /tmp/dspam)
==31967== by 0x8057039: process_connection (in /tmp/dspam)
==31967== by 0x490ED4B: start_thread (pthread_create.c:308)
==31967== by 0x6C50DDD: clone (clone.S:130)
==31967==

Attaching full valgrind output. The problem is line in dspam.c, line 1707:

1701 strcpy(plus, atsign);

Attaching sample code that repro's the problem:

% gcc dspam-corruption.c && ./a.out
username: 0x8363020 dave+foo.bar@mail.example.com
username: 0x8363020 dave@maie.coample.com
mailbox: 0x8363020 dave+foo.bar@mail.example.com

[Dave Dribin]

Adding attachments,

[Dave Dribin]

The fix is to use memmove instead of strcpy, since memmove allows for overlapping. Attaching patch.