[exim-dev] [Bug 2857] Off by one error in parse_forward_list…

Top Page
Delete this message
Reply to this message
Author: admin
Date:  
To: exim-dev
Subject: [exim-dev] [Bug 2857] Off by one error in parse_forward_list() leads to SIGSEGV
https://bugs.exim.org/show_bug.cgi?id=2857

Git Commit <git@???> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |git@???


--- Comment #4 from Git Commit <git@???> ---
Git commit:
https://git.exim.org/exim.git/commitdiff/7ad863f3819407559cd654639c25dcae427c190f

commit 7ad863f3819407559cd654639c25dcae427c190f
Author:     Jeremy Harris <jgh146exb@???>
AuthorDate: Sun Feb 6 19:00:26 2022 +0000
Commit:     Jeremy Harris <jgh146exb@???>
CommitDate: Sun Feb 6 20:03:08 2022 +0000


    Fix bogus error message copy.  Bug 2857


    Broken-by: bb43acbd98
---
 src/src/parse.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)


diff --git a/src/src/parse.c b/src/src/parse.c
index 5bf97ea..edbee26 100644
--- a/src/src/parse.c
+++ b/src/src/parse.c
@@ -1354,15 +1354,16 @@ for (;;)

   if (special)
     {
-    uschar *ss = Ustrchr(s+1, ':') + 1;
+    uschar * ss = Ustrchr(s+1, ':') + 1; /* line after the special... */
     if ((options & specopt) == specbit)
       {
       *error = string_sprintf("\"%.*s\" is not permitted", len, s);
       return FF_ERROR;
       }
-    while (*ss && isspace(*ss)) ss++;
-    while (s[len] && s[len] != '\n') len++;
-    *error = string_copyn(ss, s + len - ss);
+    while (*ss && isspace(*ss)) ss++;    /* skip leading whitespace */
+    if ((len = Ustrlen(ss)) > 0)    /* ignore trailing newlines */
+      for (const uschar * t = ss + len - 1; t >= ss && *t == '\n'; t--) len--;
+    *error = string_copyn(ss, len);    /* becomes the error */
     return special;
     }


--
You are receiving this mail because:
You are on the CC list for the bug.