[exim-cvs] taint SNI values supplied by client

Gitweb: https://git.exim.org/exim.git/commitdiff/89a80675800115043189ea51437b062d88fa51b7

Commit:     89a80675800115043189ea51437b062d88fa51b7
Parent:     314db5bae8fbce6bf72f37096dc3a042696e8448
Author:     Jeremy Harris <jgh146exb@???>
AuthorDate: Mon Aug 19 15:50:57 2019 +0100
Committer:  Jeremy Harris <jgh146exb@???>
CommitDate: Mon Aug 19 15:57:13 2019 +0100

    taint SNI values supplied by client
---
 src/src/tls-gnu.c     | 2 +-
 src/src/tls-openssl.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index de44313..973b135 100644
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -1957,7 +1957,7 @@ if (sni_type != GNUTLS_NAME_DNS)
/* We now have a UTF-8 string in sni_name */
old_pool = store_pool;
store_pool = POOL_PERM;
-state->received_sni = string_copyn(US sni_name, data_len);
+state->received_sni = string_copy_taint(US sni_name, TRUE);
store_pool = old_pool;

/* We set this one now so that variable expansions below will work */
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index d686720..b9798f6 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -1570,7 +1570,7 @@ DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,

/* Make the extension value available for expansion */
store_pool = POOL_PERM;
-tls_in.sni = string_copy(US servername);
+tls_in.sni = string_copy_taint(US servername, TRUE);
store_pool = old_pool;

if (!reexpand_tls_files_for_sni)