From acb8e0f62962869f316d345f5dae0c7dfc9ff6b7 Mon Sep 17 00:00:00 2001
From: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
Date: Fri, 21 Jul 2023 15:28:48 +0200
Subject: [PATCH] Handle missing `<bind>`

This patch handles the case where the server sends its list of features,
but the `<bind>` feature is missing.
A server doing so is violating RFC6120 (c.f. [0]), but it happened in [1].
Previously we ended up in a segfault, now we terminate the connection.

Reproducing this was done with netcat and profanity:

```
shell1    $ nc -l -p 5222
profanity $ /connect foo@127.0.0.1 tls disable

-> nc receives: '<?xml version="1.0"?><stream:stream to="127.0.0.1" xml:lang="en" version="1.0" xmlns="jabber:client" xmlns:stream="http://etherx.jabber.org/streams">'

nc send: <?xml version="1.0"?>
<stream:stream from="127.0.0.1" id="foobarbaz" lang="en" version="1.0" xmlns:stream="http://etherx.jabber.org/streams">
<features xmlns="http://etherx.jabber.org/streams"><mechanisms xmlns="urn:ietf:params:xml:ns:xmpp-sasl"><mechanism>PLAIN</mechanism></mechanisms></features>

-> nc receives: '<auth mechanism="PLAIN" xmlns="urn:ietf:params:xml:ns:xmpp-sasl">XXXXXXXXXX</auth>'

nc send: <success xmlns="urn:ietf:params:xml:ns:xmpp-sasl"/>

-> nc receives: '<?xml version="1.0"?><stream:stream to="127.0.0.1" xml:lang="en" version="1.0" xmlns="jabber:client" xmlns:stream="http://etherx.jabber.org/streams"><stream:stream from="127.0.0.1" id="foobarbaz" lang="en" version="1.0" xmlns:stream="http://etherx.jabber.org/streams">'

nc send: <?xml version="1.0"?>
<stream:stream from="127.0.0.1" id="foobarbaz" lang="en" version="1.0" xmlns:stream="http://etherx.jabber.org/streams">
<features xmlns="http://etherx.jabber.org/streams"/>

-> pre-patch this lead to a segfault of profanity, now the stream gets closed.
```

[0] https://datatracker.ietf.org/doc/html/rfc6120#section-7.2
[1] https://github.com/profanity-im/profanity/issues/1849

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
---
 src/auth.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/src/auth.c b/src/auth.c
index 442bb3f..30161c0 100644
--- a/src/auth.c
+++ b/src/auth.c
@@ -939,6 +939,13 @@ _handle_features_sasl(xmpp_conn_t *conn, xmpp_stanza_t *stanza, void *userdata)
     if (bind) {
         ns = xmpp_stanza_get_ns(bind);
         conn->bind_required = ns != NULL && strcmp(ns, XMPP_NS_BIND) == 0;
+        bind = xmpp_stanza_copy(bind);
+        if (!bind) {
+            disconnect_mem_error(conn);
+            return 0;
+        }
+    } else {
+        conn->bind_required = 0;
     }
 
     /* check whether session establishment is required */
@@ -956,12 +963,6 @@ _handle_features_sasl(xmpp_conn_t *conn, xmpp_stanza_t *stanza, void *userdata)
         conn->sm_state->sm_support = 1;
     }
 
-    bind = xmpp_stanza_copy(bind);
-    if (!bind) {
-        disconnect_mem_error(conn);
-        return 0;
-    }
-
     /* we are expecting either <bind/> and <session/> since this is a
        XMPP style connection or we <resume/> the previous session */
 
@@ -989,7 +990,9 @@ _handle_features_sasl(xmpp_conn_t *conn, xmpp_stanza_t *stanza, void *userdata)
         _do_bind(conn, bind);
     } else {
         /* can't bind, disconnect */
-        xmpp_stanza_release(bind);
+        if (bind) {
+            xmpp_stanza_release(bind);
+        }
         strophe_error(conn->ctx, "xmpp",
                       "Stream features does not allow "
                       "resource bind.");