diff options
| author | Jeremy Harris <jgh146exb@wizmail.org> | 2020-12-23 22:35:04 +0000 |
|---|---|---|
| committer | Jeremy Harris <jgh146exb@wizmail.org> | 2020-12-24 00:16:30 +0000 |
| commit | 942f0be6c2cd3ec8c39ca234a449561d9d3c1075 (patch) | |
| tree | 84bba75d64ea1dc5f86f6c36bc62ab75c3c58fe9 /src | |
| parent | 94ecf089d68ac5b85c2a99177a8e4b4d35d5aa2e (diff) | |
Fix ${listextract } from a tainted list
Diffstat (limited to 'src')
| -rw-r--r-- | src/src/expand.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/src/expand.c b/src/src/expand.c index 21758d832..839821ef7 100644 --- a/src/src/expand.c +++ b/src/src/expand.c @@ -1298,15 +1298,16 @@ expand_getlistele(int field, const uschar * list) { const uschar * tlist = list; int sep = 0; -uschar dummy; +/* Tainted mem for the throwaway element copies */ +uschar * dummy = store_get(2, TRUE); if (field < 0) { - for (field++; string_nextinlist(&tlist, &sep, &dummy, 1); ) field++; + for (field++; string_nextinlist(&tlist, &sep, dummy, 1); ) field++; sep = 0; } if (field == 0) return NULL; -while (--field > 0 && (string_nextinlist(&list, &sep, &dummy, 1))) ; +while (--field > 0 && (string_nextinlist(&list, &sep, dummy, 1))) ; return string_nextinlist(&list, &sep, NULL, 0); } |