Re: [Exim] verify=header_syntax Buffer overflow (CAN-2004-04…

Top Page
Delete this message
Reply to this message
Author: Andreas Metzler
Date:  
To: Exim-Users (E-mail)
Old-Topics: [Exim] verify=header_syntax Buffer overflow
Subject: Re: [Exim] verify=header_syntax Buffer overflow (CAN-2004-0400)
On 2004-05-06 Nico Erfurth <masta@???> wrote:
> If anyone missed it:


> http://www.guninski.com/exim1.html


Hello,
Afaict the broken code in src/verify.c is completely useless in exim4.
The header name is copied to hname but the error message is generated
from h->text and hname is ignored.

Therefore this should also fix it.
--------------------
--- exim4-4.32/src/verify.c     2004-05-06 14:06:25.000000000 +0200
+++ exim4-4.32/src/verify.c.fix.nice    2004-05-06 14:03:31.000000000 +0200
@@ -1259,14 +1259,10 @@


     if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
       {
-      uschar hname[64];
-      uschar *t = h->text;
-      uschar *tt = hname;
+      uschar *t;
       uschar *verb = US"is";
       int len;


-      while (*t != ':') *tt++ = *t++;
-      *tt = 0;


       /* Arrange not to include any white space at the end in the
       error message. */
--------------------


Shouldn't exim reject

To        : bar@foo


at east if 'verify = header_syntax' is used?

There is another bug hidden somewhere with this because
----------------
swaks -s localhost -t ametzler@localhost -f ametzler@localhost \
-d'Date: %D\nTo                             : %T\nFrom: %F\nSubject: test %D\n\nJust a test2\n'
----------------


will deliver this:
-------------
>From localhost Thu May 06 15:48:39 2004

Return-path: localhost
Envelope-to: localhost
Delivery-date: Thu, 06 May 2004 15:48:39 +0200
Received: from downhill.univie.ac.at ([127.0.0.1])
        by downhill.univie.ac.at with esmtp (Exim 4.32)
        id 1BLjEt-0007f2-OX
        for localhost; Thu, 06 May 2004 15:48:39 +0200
Date: Thu, 06 May 2004 15:48:39 +0200


To                             :  localhost
From: localhost
Subject: test Thu, 06 May 2004 15:48:39 +0200
Message-ID: <E1BLjEt-0007f2-OX@???>


Just a test2
-------------

Please note the empty line after the Date: header.
              cu andreas
--
"See, I told you they'd listen to Reason," [SPOILER] Svfurlr fnlf,
fuhggvat qbja gur juveyvat tha.
Neal Stephenson in "Snow Crash"