diff options
| author | Jeremy Harris <jgh146exb@wizmail.org> | 2019-03-14 12:26:34 +0000 |
|---|---|---|
| committer | Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de> | 2019-07-19 08:55:06 +0200 |
| commit | a189eb636256833f3053d8f2fbb95e51dc0f936c (patch) | |
| tree | 5ace998ca9698bb71dfc524f9001ca4525a9c0a4 | |
| parent | a457174087afff3685856e295bd8ffcfefe0e05e (diff) | |
| download | exim4-a189eb636256833f3053d8f2fbb95e51dc0f936c.tar.gz | |
Fix crash from SRV lookup hitting a CNAME
(cherry picked from commit 14bc9cf085aff7bd5147881e5b7068769a29b026)
(cherry picked from commit 09720dd9506176294154dad7152f5f40554046a4)
| -rw-r--r-- | doc/doc-txt/ChangeLog | 4 | ||||
| -rw-r--r-- | src/src/dns.c | 10 |
2 files changed, 11 insertions, 3 deletions
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index 26221318e..585ccffc8 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -27,6 +27,10 @@ JH/07 GnuTLS: Our use of late (post-handshake) certificate verification, under JB/01 Bug 2375: fix expansions of 822 addresses having comments in local-part and/or domain. Found and fixed by Jason Betts. +JH/08 Add hardening against SRV & TLSA lookups the hit CNAMEs (a nonvalid + configuration). If a CNAME target was not a wellformed name pattern, a + crash could result. + Exim version 4.92 ----------------- diff --git a/src/src/dns.c b/src/src/dns.c index 0f0b435de..b7978c521 100644 --- a/src/src/dns.c +++ b/src/src/dns.c @@ -716,7 +716,11 @@ lookup, which constructs the names itself, so they should be OK. Besides, bitstring labels don't conform to normal name syntax. (But the aren't used any more.) -For SRV records, we omit the initial _smtp._tcp. components at the start. */ +For SRV records, we omit the initial _smtp._tcp. components at the start. +The check has been seen to bite on the destination of a SRV lookup that +initiall hit a CNAME, for which the next name had only two components. +RFC2782 makes no mention of the possibiility of CNAMES, but the Wikipedia +article on SRV says they are not a valid configuration. */ #ifndef STAND_ALONE /* Omit this for stand-alone tests */ @@ -732,8 +736,8 @@ if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT) if (type == T_SRV || type == T_TLSA) { - while (*checkname++ != '.'); - while (*checkname++ != '.'); + while (*checkname && *checkname++ != '.') ; + while (*checkname && *checkname++ != '.') ; } if (pcre_exec(regex_check_dns_names, NULL, CCS checkname, Ustrlen(checkname), |