CVS: cvs.openbsd.org: src

CVSROOT:	/cvs
Module name:	src
Changes by:	[email protected]	2026/07/12 17:30:54

Modified files:
	usr.sbin/smtpd : mda_mbox.c 

Log message:
reject empty or slash-bearing usernames before building the mbox path

mda_mbox_init() builds _PATH_MAILDIR/username and creates and chowns it as
root.  the username comes from K_USERINFO table data, which is not checked
for slashes, so a dynamic userbase returning a slashed username could make
root create a path outside the mailbox namespace. in practice, it does not
affect default userbase which goes through getpwnam(), and it requires the
admin to voluntarily create a badly crafted username in the userbase.

from Andrew Griffiths (fixed by me), ok op@