Fix a possible denial of service vulnerability.

After this patch, the action of piping mails out won't stop,
even if all of your mails were failed to deliver. Nullmailer
itself will keep throwing mails to smart relay as long as
there're incoming mails, no matter how broken the recipients
of the previous mails.

Still leave this port in FORBIDDEN state until I address
PR ports/45152

Obtained from: http://www.debian.org/security/2002/dsa-198
Noted by: Volker Stolz <stolz@i2.informatik.rwth-aachen.de>
This commit is contained in:
Clive Lin 2002-11-24 10:46:58 +00:00
parent b502e7847f
commit e4e7c4c253
Notes: svn2git 2021-03-31 03:12:20 +00:00
svn path=/head/; revision=70990
3 changed files with 35 additions and 0 deletions

View file

@ -8,3 +8,13 @@
#include "configio.h"
#include "defines.h"
#include "errcodes.h"
@@ -233,8 +234,7 @@
<< itoa(files.count()) << " message(s) in queue." << endl;
for(rlist::iter remote(remotes); remote; remote++) {
for(slist::iter file(files); file; files.remove(file)) {
- if(!send_one(*file, *remote))
- break;
+ send_one(*file, *remote);
}
}
fout << "Delivery complete, "

View file

@ -0,0 +1,11 @@
--- src/sendmail.cc
+++ src/sendmail.cc
@@ -84,7 +84,7 @@
str[varlen] = '=';
memcpy(str+varlen+1, val, vallen);
str[varlen+vallen+1] = 0;
- return putenv(str);
+ return putenv(strdup(str));
}
#endif

View file

@ -0,0 +1,14 @@
--- protocols/smtp.cc
+++ protocols/smtp.cc
@@ -120,9 +120,8 @@
docmd("DATA", 300);
mystring tmp;
while(msg->getline(tmp)) {
- if((tmp[0] == '.' && tmp[1] == 0 && !(out << ".")) ||
- !(out << tmp << "\r\n"))
- exit(ERR_MSG_WRITE);
+ if(tmp[0] == '.' && !(out << ".")) exit(ERR_MSG_WRITE);
+ if(!(out << tmp << "\r\n")) exit(ERR_MSG_WRITE);
}
docmd(".", 200);
}