diff options
author | Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de> | 2021-03-29 23:05:58 +0200 |
---|---|---|
committer | Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de> | 2021-04-28 00:40:42 +0200 |
commit | 605716b999a4ca6c7d5777ab7463058e9b055dc2 (patch) | |
tree | 8ac2e1636f0ad62a1f77cb15b954e34bcd1646fd | |
parent | f9c58fb385343b8e3fa13988efcbd30ae3285ea7 (diff) | |
download | exim4-605716b999a4ca6c7d5777ab7463058e9b055dc2.tar.gz |
CVE-2020-28017: Integer overflow in receive_add_recipient()
Based on Phil Pennock's commit e3b441f7.
(cherry picked from commit 18a19e18242edc5ab2082fa9c41cd6210d1b6087)
-rw-r--r-- | src/src/receive.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/src/src/receive.c b/src/src/receive.c index 5c6420286..cf3ef4b96 100644 --- a/src/src/receive.c +++ b/src/src/receive.c @@ -485,18 +485,18 @@ Returns: nothing void receive_add_recipient(uschar *recipient, int pno) { -/* XXX This is a math limit; we should consider a performance/sanity limit too. */ -const int safe_recipients_limit = INT_MAX / sizeof(recipient_item) - 1; - if (recipients_count >= recipients_list_max) { recipient_item *oldlist = recipients_list; int oldmax = recipients_list_max; - recipients_list_max = recipients_list_max ? 2*recipients_list_max : 50; - if ((recipients_list_max >= safe_recipients_limit) || (recipients_list_max < 0)) + + const int safe_recipients_limit = INT_MAX / 2 / sizeof(recipient_item); + if (recipients_list_max < 0 || recipients_list_max >= safe_recipients_limit) { - log_write(0, LOG_MAIN|LOG_PANIC, "Too many recipients needed: %d not satisfiable", recipients_list_max); + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Too many recipients: %d", recipients_list_max); } + + recipients_list_max = recipients_list_max ? 2*recipients_list_max : 50; recipients_list = store_get(recipients_list_max * sizeof(recipient_item), FALSE); if (oldlist != NULL) memcpy(recipients_list, oldlist, oldmax * sizeof(recipient_item)); |