Commit | Line | Data |
---|---|---|
0c0c20aa AM |
1 | From b5052a65ed1ba81269ac5a03b4505aa9d55ce084 Mon Sep 17 00:00:00 2001 |
2 | From: Qualys Security Advisory <qsa@qualys.com> | |
3 | Date: Sun, 21 Feb 2021 19:46:55 -0800 | |
4 | Subject: [PATCH 08/29] CVE-2020-28017: Integer overflow in | |
5 | receive_add_recipient() | |
6 | ||
7 | Based on Phil Pennock's commit e3b441f7. | |
8 | --- | |
9 | src/receive.c | 10 ++++++++-- | |
10 | 1 file changed, 8 insertions(+), 2 deletions(-) | |
11 | ||
12 | diff --git a/src/receive.c b/src/receive.c | |
13 | index a0467e8c8..227ace084 100644 | |
14 | --- a/src/receive.c | |
15 | +++ b/src/receive.c | |
16 | @@ -488,6 +488,12 @@ if (recipients_count >= recipients_list_max) | |
17 | { | |
18 | recipient_item *oldlist = recipients_list; | |
19 | int oldmax = recipients_list_max; | |
20 | + | |
21 | + const int safe_recipients_limit = INT_MAX / 2 / sizeof(recipient_item); | |
22 | + if (recipients_list_max < 0 || recipients_list_max >= safe_recipients_limit) | |
23 | + { | |
24 | + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Too many recipients: %d", recipients_list_max); | |
25 | + } | |
26 | recipients_list_max = recipients_list_max ? 2*recipients_list_max : 50; | |
27 | recipients_list = store_get(recipients_list_max * sizeof(recipient_item)); | |
28 | if (oldlist != NULL) | |
29 | @@ -4070,7 +4076,7 @@ if (message_logs && !blackholed_by) | |
30 | { | |
31 | int fd; | |
32 | uschar * m_name = spool_fname(US"msglog", message_subdir, message_id, US""); | |
33 | - | |
34 | + | |
35 | if ( (fd = Uopen(m_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE)) < 0 | |
36 | && errno == ENOENT | |
37 | ) | |
38 | @@ -4229,7 +4235,7 @@ if(!smtp_reply) | |
39 | if (f.deliver_freeze) log_write(0, LOG_MAIN, "frozen by %s", frozen_by); | |
40 | if (f.queue_only_policy) log_write(L_delay_delivery, LOG_MAIN, | |
41 | "no immediate delivery: queued%s%s by %s", | |
42 | - *queue_name ? " in " : "", *queue_name ? CS queue_name : "", | |
43 | + *queue_name ? " in " : "", *queue_name ? CS queue_name : "", | |
44 | queued_by); | |
45 | } | |
46 | f.receive_call_bombout = FALSE; | |
47 | -- | |
48 | 2.30.2 | |
49 |