[exim-cvs] CVE-2020-28025: Heap out-of-bounds read in pdkim…

Gitweb: https://git.exim.org/exim.git/commitdiff/8761187029d998a942eaa1c0cc26592f52245446

Commit:     8761187029d998a942eaa1c0cc26592f52245446
Parent:     c7f4ea442a264b5cb3a9ef0eed641f4778dfb5b7
Author:     Qualys Security Advisory <qsa@???>
AuthorDate: Sun Feb 21 18:54:16 2021 -0800
Committer:  Heiko Schlittermann (HS12-RIPE) <hs@???>
CommitDate: Thu May 27 21:30:44 2021 +0200

    CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()

    (cherry picked from commit cad30cd3fb96196e908e0d66b1b45fdf377c850c)
    (cherry picked from commit 1c261b90f627f0489f7dfcf1e66b46cce67f477d)
---
 src/src/pdkim/pdkim.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/src/pdkim/pdkim.c b/src/src/pdkim/pdkim.c
index 0ad4d12..074106b 100644
--- a/src/src/pdkim/pdkim.c
+++ b/src/src/pdkim/pdkim.c
@@ -825,7 +825,7 @@ for (pdkim_signature * sig = ctx->sig; sig; sig = sig->next)
/* VERIFICATION --------------------------------------------------------- */
/* Be careful that the header sig included a bodyash */

-    if (  sig->bodyhash.data
+    if (sig->bodyhash.data && sig->bodyhash.len == b->bh.len
        && memcmp(b->bh.data, sig->bodyhash.data, b->bh.len) == 0)
       {
       DEBUG(D_acl) debug_printf("DKIM [%s] Body hash compared OK\n", sig->domain);