diff options
| author | Phil Pennock <phil+git@pennock-tech.com> | 2020-10-29 22:40:59 -0400 |
|---|---|---|
| committer | Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de> | 2021-05-27 21:30:30 +0200 |
| commit | 518f0a0dd6df6f0d0ea51bfa126982d134e7a7ff (patch) | |
| tree | 0b32bf62a154a2f8c036313e630089a939f4ded0 | |
| parent | 0695aae1eb75b439862d0f7fbf099b5d08f55af0 (diff) | |
SECURITY: fix SMTP verb option parsing
A boundary case in looking for an opening quote before the closing quote could
walk off the front of the buffer.
(cherry picked from commit 515d8d43a18481d23d7cf410b8dc71b4e254ebb8)
(cherry picked from commit 467948de0c407bd2bbc2e84abbbf09f35b035538)
| -rw-r--r-- | doc/doc-txt/ChangeLog | 3 | ||||
| -rw-r--r-- | src/src/smtp_in.c | 5 |
2 files changed, 6 insertions, 2 deletions
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index 3d0e638d2..9837d6c0f 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -285,6 +285,9 @@ PP/09 Fix security issue with too many recipients on a message (to remove a or if local additions add to the recipient list). Fixes CVE-2020-RCPTL reported by Qualys. +PP/10 Fix security issue in SMTP verb option parsing + Fixes CVE-2020-EXOPT reported by Qualys. + Exim version 4.94 ----------------- diff --git a/src/src/smtp_in.c b/src/src/smtp_in.c index d60e7d5c5..4f16fd4b8 100644 --- a/src/src/smtp_in.c +++ b/src/src/smtp_in.c @@ -1969,12 +1969,13 @@ extract_option(uschar **name, uschar **value) uschar *n; uschar *v = smtp_cmd_data + Ustrlen(smtp_cmd_data) - 1; while (isspace(*v)) v--; -v[1] = 0; +v[1] = '\0'; while (v > smtp_cmd_data && *v != '=' && !isspace(*v)) { /* Take care to not stop at a space embedded in a quoted local-part */ - if (*v == '"') do v--; while (*v != '"' && v > smtp_cmd_data+1); + if ((*v == '"') && (v > smtp_cmd_data + 1)) + do v--; while (*v != '"' && v > smtp_cmd_data+1); v--; } |