diff options
| -rw-r--r-- | doc/doc-txt/ChangeLog | 8 | ||||
| -rw-r--r-- | src/src/smtp_in.c | 10 |
2 files changed, 16 insertions, 2 deletions
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index e8884a29f..9aed3bb90 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -1,4 +1,4 @@ -$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.125 2005/04/27 10:06:00 ph10 Exp $ +$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.126 2005/04/27 10:55:20 ph10 Exp $ Change log file for Exim from version 4.21 ------------------------------------------- @@ -239,6 +239,12 @@ PH/38 Installed a patch from Ian Freislich, with the agreement of Tom Kistner. PH/39 Allow G after quota size as well as K and M. +PH/40 The value set for $authenticated_id in an authenticator may not contain + binary zeroes or newlines because the value is written to log lines and + to spool files. There was no check on this. Now the value is run through + the string_printing() function so that such characters are converted to + printable escape sequences. + A note about Exim versions 4.44 and 4.50 ---------------------------------------- diff --git a/src/src/smtp_in.c b/src/src/smtp_in.c index c10293c87..bdc323325 100644 --- a/src/src/smtp_in.c +++ b/src/src/smtp_in.c @@ -1,4 +1,4 @@ -/* $Cambridge: exim/src/src/smtp_in.c,v 1.15 2005/03/29 15:53:12 ph10 Exp $ */ +/* $Cambridge: exim/src/src/smtp_in.c,v 1.16 2005/04/27 10:55:20 ph10 Exp $ */ /************************************************* * Exim - an Internet mail transport agent * @@ -2113,6 +2113,14 @@ while (done <= 0) if (au->set_id != NULL) set_id = expand_string(au->set_id); expand_nmax = -1; /* Reset numeric variables */ + /* The value of authenticated_id is stored in the spool file and printed in + log lines. It must not contain binary zeros or newline characters. In + normal use, it never will, but when playing around or testing, this error + can (did) happen. To guard against this, ensure that the id contains only + printing characters. */ + + if (set_id != NULL) set_id = string_printing(set_id); + /* For the non-OK cases, set up additional logging data if set_id is not empty. */ |