[evolution-data-server/gnome-3-36] I#226 - CVE-2020-14928: Response Injection via STARTTLS in SMTP and POP3

[Milan Crha <mcrha src gnome org>]

commit f404f33fb01b23903c2bbb16791c7907e457fbac
Author: Milan Crha <mcrha redhat com>
Date:   Mon Jun 22 13:42:41 2020 +0200

    I#226 - CVE-2020-14928: Response Injection via STARTTLS in SMTP and POP3
    
    Closes https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/226

 src/camel/camel-stream-buffer.c                 | 19 +++++++++++++++++++
 src/camel/camel-stream-buffer.h                 |  1 +
 src/camel/providers/pop3/camel-pop3-store.c     |  2 ++
 src/camel/providers/pop3/camel-pop3-stream.c    | 11 +++++++++++
 src/camel/providers/pop3/camel-pop3-stream.h    |  1 +
 src/camel/providers/smtp/camel-smtp-transport.c |  2 ++
 6 files changed, 36 insertions(+)
---
diff --git a/src/camel/camel-stream-buffer.c b/src/camel/camel-stream-buffer.c
index 3e2e0dd36..d39fd8bdb 100644
--- a/src/camel/camel-stream-buffer.c
+++ b/src/camel/camel-stream-buffer.c
@@ -518,3 +518,22 @@ camel_stream_buffer_read_line (CamelStreamBuffer *sbf,
 
        return g_strdup ((gchar *) sbf->priv->linebuf);
 }
+
+/**
+ * camel_stream_buffer_truncate:
+ * @sbf: a #CamelStreamBuffer
+ *
+ * Truncates any cached data in the @sbf. The next read reads
+ * from the stream.
+ *
+ * Since: 3.36.4
+ **/
+void
+camel_stream_buffer_truncate (CamelStreamBuffer *sbf)
+{
+       g_return_if_fail (CAMEL_IS_STREAM_BUFFER (sbf));
+
+       sbf->priv->ptr = sbf->priv->buf;
+       sbf->priv->end = sbf->priv->buf;
+       sbf->priv->ptr[0] = '\0';
+}
diff --git a/src/camel/camel-stream-buffer.h b/src/camel/camel-stream-buffer.h
index ef92cfd8e..094e9926b 100644
--- a/src/camel/camel-stream-buffer.h
+++ b/src/camel/camel-stream-buffer.h
@@ -93,6 +93,7 @@ gint          camel_stream_buffer_gets        (CamelStreamBuffer *sbf,
 gchar *                camel_stream_buffer_read_line   (CamelStreamBuffer *sbf,
                                                 GCancellable *cancellable,
                                                 GError **error);
+void           camel_stream_buffer_truncate    (CamelStreamBuffer *sbf);
 
 G_END_DECLS
 
diff --git a/src/camel/providers/pop3/camel-pop3-store.c b/src/camel/providers/pop3/camel-pop3-store.c
index 81c370f0a..5c9eb1eaa 100644
--- a/src/camel/providers/pop3/camel-pop3-store.c
+++ b/src/camel/providers/pop3/camel-pop3-store.c
@@ -205,6 +205,8 @@ connect_to_server (CamelService *service,
 
        if (tls_stream != NULL) {
                camel_stream_set_base_stream (stream, tls_stream);
+               /* Truncate any left cached input from the insecure part of the session */
+               camel_pop3_stream_truncate (pop3_engine->stream);
                g_object_unref (tls_stream);
        } else {
                g_prefix_error (
diff --git a/src/camel/providers/pop3/camel-pop3-stream.c b/src/camel/providers/pop3/camel-pop3-stream.c
index 74bb11e61..c485b9bd6 100644
--- a/src/camel/providers/pop3/camel-pop3-stream.c
+++ b/src/camel/providers/pop3/camel-pop3-stream.c
@@ -457,3 +457,14 @@ camel_pop3_stream_getd (CamelPOP3Stream *is,
 
        return 1;
 }
+
+void
+camel_pop3_stream_truncate (CamelPOP3Stream *is)
+{
+       if (is) {
+               is->ptr = is->end = is->buf;
+               is->lineptr = is->linebuf;
+               is->lineend = is->linebuf + CAMEL_POP3_STREAM_LINE_SIZE;
+               is->ptr[0] = '\n';
+       }
+}
diff --git a/src/camel/providers/pop3/camel-pop3-stream.h b/src/camel/providers/pop3/camel-pop3-stream.h
index bb6dbb903..128c8c45a 100644
--- a/src/camel/providers/pop3/camel-pop3-stream.h
+++ b/src/camel/providers/pop3/camel-pop3-stream.h
@@ -87,6 +87,7 @@ gint          camel_pop3_stream_getd          (CamelPOP3Stream *is,
                                                 guint *len,
                                                 GCancellable *cancellable,
                                                 GError **error);
+void           camel_pop3_stream_truncate      (CamelPOP3Stream *is);
 
 G_END_DECLS
 
diff --git a/src/camel/providers/smtp/camel-smtp-transport.c b/src/camel/providers/smtp/camel-smtp-transport.c
index 035baf367..1fc0f3206 100644
--- a/src/camel/providers/smtp/camel-smtp-transport.c
+++ b/src/camel/providers/smtp/camel-smtp-transport.c
@@ -323,6 +323,8 @@ connect_to_server (CamelService *service,
 
        if (tls_stream != NULL) {
                camel_stream_set_base_stream (stream, tls_stream);
+               /* Truncate any left cached input from the insecure part of the session */
+               camel_stream_buffer_truncate (transport->istream);
                g_object_unref (tls_stream);
        } else {
                g_prefix_error (