[exim-cvs] SECURITY: default recipients_max to 50,000

Inizio della pagina
Delete this message
Reply to this message
Autore: Exim Git Commits Mailing List
Data:  
To: exim-cvs
Oggetto: [exim-cvs] SECURITY: default recipients_max to 50,000
Gitweb: https://git.exim.org/exim.git/commitdiff/f07847e436d1130628717ef92e46b56b293d5fa1
Commit:     f07847e436d1130628717ef92e46b56b293d5fa1
Parent:     410b935d8ed35762b76b0edfa7a9fb9ba6500ebd
Author:     Phil Pennock <phil+git@???>
AuthorDate: Thu Oct 29 21:38:25 2020 -0400
Committer:  Heiko Schlittermann (HS12-RIPE) <hs@???>
CommitDate: Thu May 27 21:30:28 2021 +0200


    SECURITY: default recipients_max to 50,000


    A default of "unlimited" can have unfortunate consequences when people start
    putting many millions of recipients on a message.


    (cherry picked from commit 1d7780722a66cea8da5fa4ae0775e85d185fbf7e)
    (cherry picked from commit a6e1f69d82adcfd3caab8f228d96750dfddc8f07)
---
 doc/doc-docbook/spec.xfpt   | 2 +-
 doc/doc-txt/ChangeLog       | 2 ++
 doc/doc-txt/OptionLists.txt | 2 +-
 src/src/globals.c           | 2 +-
 4 files changed, 5 insertions(+), 3 deletions(-)


diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 61abb70..68d9c05 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -17394,7 +17394,7 @@ or if the message was submitted locally (not using TCP/IP), and the &%-bnq%&
option was not set.


-.option recipients_max main integer 0
+.option recipients_max main integer 50000
 .cindex "limit" "number of recipients"
 .cindex "recipient" "maximum number"
 If this option is set greater than zero, it specifies the maximum number of
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 5a9c8f2..89a60e7 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -278,6 +278,8 @@ PP/06 Fix CVE-2020-28016 (PFPZA): Heap out-of-bounds write in parse_fix_phrase()
 PP/07 Refuse to allocate too little memory, block negative/zero allocations.
       Security guard.


+PP/08 Change default for recipients_max from unlimited to 50,000.
+

 Exim version 4.94
 -----------------
diff --git a/doc/doc-txt/OptionLists.txt b/doc/doc-txt/OptionLists.txt
index 183f6b7..59be0a0 100644
--- a/doc/doc-txt/OptionLists.txt
+++ b/doc/doc-txt/OptionLists.txt
@@ -466,7 +466,7 @@ receive_timeout                      time            0s            main
 received_header_text                 string*         +             main
 received_headers_max                 integer         30            main
 recipient_unqualified_hosts          host list       unset         main              4.00 replacing receiver_unqualified_hosts
-recipients_max                       integer         0             main              1.60
+recipients_max                       integer         50000         main              1.60 default changed in 4.95 (was 0)
 recipients_max_reject                boolean         false         main              1.70
 redirect_router                      string          unset         routers           4.00
 remote_max_parallel                  integer         1             main
diff --git a/src/src/globals.c b/src/src/globals.c
index c45e8a9..bd874a7 100644
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -1295,7 +1295,7 @@ uschar *recipient_verify_failure = NULL;
 int     recipients_count       = 0;
 recipient_item  *recipients_list = NULL;
 int     recipients_list_max    = 0;
-int     recipients_max         = 0;
+int     recipients_max         = 50000;
 const pcre *regex_AUTH         = NULL;
 const pcre *regex_check_dns_names = NULL;
 const pcre *regex_From         = NULL;