diff options
| author | Jeremy Harris <jgh146exb@wizmail.org> | 2020-12-23 22:35:04 +0000 |
|---|---|---|
| committer | Jeremy Harris <jgh146exb@wizmail.org> | 2020-12-24 11:23:09 +0000 |
| commit | f8f129d658e8b2e25714b09737c47623ebf2ed2f (patch) | |
| tree | a4856e093013e789dbed12622479e183a2ccf539 | |
| parent | 2dd9a491d1ff0ddc6e6fc22d6db3e9d8ba191f64 (diff) | |
| download | exim4-f8f129d658e8b2e25714b09737c47623ebf2ed2f.tar.gz | |
Fix ${listextract } from a tainted list
(cherry picked from commit 942f0be6c2cd3ec8c39ca234a449561d9d3c1075)
| -rw-r--r-- | doc/doc-txt/ChangeLog | 3 | ||||
| -rw-r--r-- | src/src/expand.c | 7 | ||||
| -rw-r--r-- | test/scripts/0000-Basic/0002 | 4 | ||||
| -rw-r--r-- | test/stdout/0002 | 2 |
4 files changed, 13 insertions, 3 deletions
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index 418b310f0..ddf755d27 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -126,6 +126,9 @@ JH/31 The ESMTP option name advertised for the SUPPORT_EARLY_PIPE build option JH/32 Bug 2599: fix delay of delivery to a local address where there is also a remote which uses callout/hold. Previously the local was queued. +JH/33 Fix a taint trap in the ${listextract } expansion when the source data + was tainted. + Exim version 4.94 ----------------- diff --git a/src/src/expand.c b/src/src/expand.c index bb9fd79ef..05de94c49 100644 --- a/src/src/expand.c +++ b/src/src/expand.c @@ -1298,15 +1298,16 @@ expand_getlistele(int field, const uschar * list) { const uschar * tlist = list; int sep = 0; -uschar dummy; +/* Tainted mem for the throwaway element copies */ +uschar * dummy = store_get(2, TRUE); if (field < 0) { - for (field++; string_nextinlist(&tlist, &sep, &dummy, 1); ) field++; + for (field++; string_nextinlist(&tlist, &sep, dummy, 1); ) field++; sep = 0; } if (field == 0) return NULL; -while (--field > 0 && (string_nextinlist(&list, &sep, &dummy, 1))) ; +while (--field > 0 && (string_nextinlist(&list, &sep, dummy, 1))) ; return string_nextinlist(&list, &sep, NULL, 0); } diff --git a/test/scripts/0000-Basic/0002 b/test/scripts/0000-Basic/0002 index a8fc0bcb2..0a24fe988 100644 --- a/test/scripts/0000-Basic/0002 +++ b/test/scripts/0000-Basic/0002 @@ -1085,3 +1085,7 @@ exim -be ${if inlist{aa}{aa} {in list}{not in list}} ${if !inlist{aa}{aa} {not in list}{in list}} **** +# listextract from tainted list +exim -be -oMs my.target.host.name +'\${listextract {2} {<. $sender_host_name}}' => '${listextract {2} {<. $sender_host_name}}' +**** diff --git a/test/stdout/0002 b/test/stdout/0002 index e12e5690a..2cb01372e 100644 --- a/test/stdout/0002 +++ b/test/stdout/0002 @@ -1012,3 +1012,5 @@ xyz > in list > in list > +> '${listextract {2} {<. my.target.host.name}}' => 'target' +> |