[exim-cvs] CVE-2020-28017: Integer overflow in receive_add_…

Commit:     feef71897f2e24910009744b3aeb735cf07da31b
Parent:     9232671764ff40285d5b1b846a118fc80020dd64
Author:     Heiko Schlittermann (HS12-RIPE) <hs@???>
AuthorDate: Mon Mar 29 23:05:58 2021 +0200
Committer:  Heiko Schlittermann (HS12-RIPE) <hs@???>
CommitDate: Thu May 27 21:30:49 2021 +0200

    CVE-2020-28017: Integer overflow in receive_add_recipient()

    Based on Phil Pennock's commit e3b441f7.

    (cherry picked from commit 18a19e18242edc5ab2082fa9c41cd6210d1b6087)
    (cherry picked from commit 605716b999a4ca6c7d5777ab7463058e9b055dc2)
---
 src/src/receive.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/src/receive.c b/src/src/receive.c
index 3a3f73e..7507440 100644
--- a/src/src/receive.c
+++ b/src/src/receive.c
@@ -486,18 +486,18 @@ Returns:      nothing
 void
 receive_add_recipient(uschar *recipient, int pno)
 {
-/* XXX This is a math limit; we should consider a performance/sanity limit too. */
-const int safe_recipients_limit = INT_MAX / sizeof(recipient_item) - 1;
-
 if (recipients_count >= recipients_list_max)
   {
   recipient_item *oldlist = recipients_list;
   int oldmax = recipients_list_max;
-  recipients_list_max = recipients_list_max ? 2*recipients_list_max : 50;
-  if ((recipients_list_max >= safe_recipients_limit) || (recipients_list_max < 0))
+
+  const int safe_recipients_limit = INT_MAX / 2 / sizeof(recipient_item);
+  if (recipients_list_max < 0 || recipients_list_max >= safe_recipients_limit)
     {
-    log_write(0, LOG_MAIN|LOG_PANIC, "Too many recipients needed: %d not satisfiable", recipients_list_max);
+    log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Too many recipients: %d", recipients_list_max);
     }
+
+  recipients_list_max = recipients_list_max ? 2*recipients_list_max : 50;
   recipients_list = store_get(recipients_list_max * sizeof(recipient_item), FALSE);
   if (oldlist)
     memcpy(recipients_list, oldlist, oldmax * sizeof(recipient_item));