diff options
| author | Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de> | 2020-11-25 22:26:53 +0100 |
|---|---|---|
| committer | Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de> | 2021-05-27 21:30:36 +0200 |
| commit | 87804cc1f325a3eb5a562b708deb0293402e1f8f (patch) | |
| tree | 72bb7077bfdbc565da59f27b4fd41c0549208b18 | |
| parent | 40b8be2e25abb7569a05c839f5d0ab6176307a75 (diff) | |
SECURITY: Check overrun rcpt_count integer
Credits: Qualys
4/ In src/smtp_in.c:
4966 case RCPT_CMD:
4967 HAD(SCH_RCPT);
4968 rcpt_count++;
....
5123 if (rcpt_count > recipients_max && recipients_max > 0)
In theory this recipients_max check can be bypassed, because the int
rcpt_count can overflow (become negative). In practice this would either
consume too much memory or generate too much network traffic, but maybe
it should be fixed anyway.
(cherry picked from commit 04139ca809fbe56d8fe9c55a77640ea9fa93b8f1)
(cherry picked from commit db96ca55137d7684a9afdf9d118feed9116906b7)
| -rw-r--r-- | src/src/smtp_in.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/src/smtp_in.c b/src/src/smtp_in.c index 93d5cece3..b6d530f93 100644 --- a/src/src/smtp_in.c +++ b/src/src/smtp_in.c @@ -5036,6 +5036,10 @@ while (done <= 0) case RCPT_CMD: HAD(SCH_RCPT); + /* We got really to many recipients. A check against configured + limits is done later */ + if (rcpt_count < 0 || rcpt_count >= INT_MAX/2) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Too many recipients: %d", rcpt_count); rcpt_count++; was_rcpt = fl.rcpt_in_progress = TRUE; @@ -5192,7 +5196,7 @@ while (done <= 0) /* Check maximum allowed */ - if (rcpt_count > recipients_max && recipients_max > 0) + if (rcpt_count+1 < 0 || rcpt_count > recipients_max && recipients_max > 0) { if (recipients_max_reject) { |