From 942f0be6c2cd3ec8c39ca234a449561d9d3c1075 Mon Sep 17 00:00:00 2001 From: Jeremy Harris Date: Wed, 23 Dec 2020 22:35:04 +0000 Subject: Fix ${listextract } from a tainted list --- src/src/expand.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/src/expand.c b/src/src/expand.c index 21758d832..839821ef7 100644 --- a/src/src/expand.c +++ b/src/src/expand.c @@ -1298,15 +1298,16 @@ expand_getlistele(int field, const uschar * list) { const uschar * tlist = list; int sep = 0; -uschar dummy; +/* Tainted mem for the throwaway element copies */ +uschar * dummy = store_get(2, TRUE); if (field < 0) { - for (field++; string_nextinlist(&tlist, &sep, &dummy, 1); ) field++; + for (field++; string_nextinlist(&tlist, &sep, dummy, 1); ) field++; sep = 0; } if (field == 0) return NULL; -while (--field > 0 && (string_nextinlist(&list, &sep, &dummy, 1))) ; +while (--field > 0 && (string_nextinlist(&list, &sep, dummy, 1))) ; return string_nextinlist(&list, &sep, NULL, 0); } -- cgit v1.2.3