From 50f20943908ad464408e3833872692cf2837e7cb Mon Sep 17 00:00:00 2001 From: David Sarkisyan Date: Sat, 22 Aug 2026 14:19:04 -0400 Subject: [PATCH] lib-sasl: Avoid null pointer in empty response check The SASL request API permits a NULL data pointer when the response size is zero. Skip the NUL scan for that empty-input case so the supported no-initial-response path does not pass NULL to memchr. Signed-off-by: David Sarkisyan --- src/lib-sasl/sasl-server-request.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lib-sasl/sasl-server-request.c b/src/lib-sasl/sasl-server-request.c index 54adf83868..e0c3d305d1 100644 --- a/src/lib-sasl/sasl-server-request.c +++ b/src/lib-sasl/sasl-server-request.c @@ -164,7 +164,7 @@ sasl_server_request_fail_on_nuls(struct sasl_server_request *req, if ((mech->def->flags & SASL_MECH_SEC_ALLOW_NULS) != 0) return FALSE; - if (memchr(data, '\0', data_size) != NULL) { + if (data_size > 0 && memchr(data, '\0', data_size) != NULL) { e_debug(req->event, "Unexpected NUL in auth data"); sasl_server_request_failure(req->mech); return TRUE;