Import Debian changes 4.92-8+deb10u6

[hcoop/debian/exim4.git] / debian / patches / 84_08-CVE-2020-28017-Integer-overflow-in-receive_add_recip.patch

diff --git a/debian/patches/84_08-CVE-2020-28017-Integer-overflow-in-receive_add_recip.patch b/debian/patches/84_08-CVE-2020-28017-Integer-overflow-in-receive_add_recip.patch
new file mode 100644 (file)
index 0000000..d621b70
--- /dev/null
+++ b/debian/patches/84_08-CVE-2020-28017-Integer-overflow-in-receive_add_recip.patch
@@ -0,0 +1,49 @@
+From b5052a65ed1ba81269ac5a03b4505aa9d55ce084 Mon Sep 17 00:00:00 2001
+From: Qualys Security Advisory <qsa@qualys.com>
+Date: Sun, 21 Feb 2021 19:46:55 -0800
+Subject: [PATCH 08/29] CVE-2020-28017: Integer overflow in
+ receive_add_recipient()
+
+Based on Phil Pennock's commit e3b441f7.
+---
+ src/receive.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/receive.c b/src/receive.c
+index a0467e8c8..227ace084 100644
+--- a/src/receive.c
++++ b/src/receive.c
+@@ -488,6 +488,12 @@ if (recipients_count >= recipients_list_max)
+   {
+   recipient_item *oldlist = recipients_list;
+   int oldmax = recipients_list_max;
++
++  const int safe_recipients_limit = INT_MAX / 2 / sizeof(recipient_item);
++  if (recipients_list_max < 0 || recipients_list_max >= safe_recipients_limit)
++    {
++    log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Too many recipients: %d", recipients_list_max);
++    }
+   recipients_list_max = recipients_list_max ? 2*recipients_list_max : 50;
+   recipients_list = store_get(recipients_list_max * sizeof(recipient_item));
+   if (oldlist != NULL)
+@@ -4070,7 +4076,7 @@ if (message_logs && !blackholed_by)
+   {
+   int fd;
+   uschar * m_name = spool_fname(US"msglog", message_subdir, message_id, US"");
+-  
++
+   if (  (fd = Uopen(m_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE)) < 0
+      && errno == ENOENT
+      )
+@@ -4229,7 +4235,7 @@ if(!smtp_reply)
+   if (f.deliver_freeze) log_write(0, LOG_MAIN, "frozen by %s", frozen_by);
+   if (f.queue_only_policy) log_write(L_delay_delivery, LOG_MAIN,
+     "no immediate delivery: queued%s%s by %s",
+-    *queue_name ? " in " : "", *queue_name ? CS queue_name : "",       
++    *queue_name ? " in " : "", *queue_name ? CS queue_name : "",
+     queued_by);
+   }
+ f.receive_call_bombout = FALSE;
+-- 
+2.30.2
+