receiver_unqualified_nets causes core dump

Top Page
Delete this message
Reply to this message
Author: Philip Blundell
Date:  
To: exim-users
Subject: receiver_unqualified_nets causes core dump
I just discovered that (with 1.62) a malformed `receiver_unqualified_nets'
line causes Exim to dump core. The offending code is this, from
verify.c:verify_setup_netlist().

char *slash = strchr(s, '/');
ip_net_item *n = store_malloc(sizeof(ip_net_item));

n->next = NULL;
*anchor = n;
anchor = &(n->next);

/* Temporarily terminate the string at the slash, and turn the initial
address into binary. */

*slash = 0;
n->size = host_aton(s, n->address);
*slash = '/';

If the string has no '/' character in it, then `slash' is NULL and *slash
causes a segmentation fault.

Is this fixed in the latest testing releases? If not, Philip, perhaps you
could put a check in. It would be nice actually if Exim could try to catch
SIGSEGV and other usually-fatal signals and write out a panic log entry (even
if it's just "killed by SIGSEGV". Otherwise, when this sort of problem
happens the Exim processes just vanish without trace.

p.