On Mon, 21 Jul 1997, Jawaid Bazyar wrote:
[patch for 1.62]
> Patch:
>
> + /* if len-9 > 256 then truncate the string! */
> + if (len > 255+9) len = 255+9;
> strncpy(filename, s+9, len-9);
The equivalent patch for exim 1.651 is:
--- exim-1.651.orig/src/parse.c Fri Jul 4 16:33:56 1997
+++ exim-1.651/src/parse.c Tue Jul 22 09:23:39 1997
@@ -1057,6 +1057,10 @@
return -1;
}
+ /* There was a buffer overrun security hole here */
+ if (flen > 255)
+ flen = 255;
+
strncpy(filename, t, flen);
filename[flen] = 0;
--
--------------------------------------------------------------------------
T J R Cutts Tel: +44 1223 333596
Dept. of Biochemistry, Tennis Court Rd., Fax: +44 1223 766002
Cambridge, CB2 1QW, UK
