mirror of
https://git.freebsd.org/ports.git
synced 2025-07-18 17:59:20 -04:00
Fix a possible denial of service vulnerability.
After this patch, the action of piping mails out won't stop, even if all of your mails were failed to deliver. Nullmailer itself will keep throwing mails to smart relay as long as there're incoming mails, no matter how broken the recipients of the previous mails. Still leave this port in FORBIDDEN state until I address PR ports/45152 Obtained from: http://www.debian.org/security/2002/dsa-198 Noted by: Volker Stolz <stolz@i2.informatik.rwth-aachen.de>
This commit is contained in:
parent
b502e7847f
commit
e4e7c4c253
Notes:
svn2git
2021-03-31 03:12:20 +00:00
svn path=/head/; revision=70990
3 changed files with 35 additions and 0 deletions
|
@ -8,3 +8,13 @@
|
|||
#include "configio.h"
|
||||
#include "defines.h"
|
||||
#include "errcodes.h"
|
||||
@@ -233,8 +234,7 @@
|
||||
<< itoa(files.count()) << " message(s) in queue." << endl;
|
||||
for(rlist::iter remote(remotes); remote; remote++) {
|
||||
for(slist::iter file(files); file; files.remove(file)) {
|
||||
- if(!send_one(*file, *remote))
|
||||
- break;
|
||||
+ send_one(*file, *remote);
|
||||
}
|
||||
}
|
||||
fout << "Delivery complete, "
|
||||
|
|
11
mail/nullmailer/files/patch-sendmail.cc
Normal file
11
mail/nullmailer/files/patch-sendmail.cc
Normal file
|
@ -0,0 +1,11 @@
|
|||
--- src/sendmail.cc
|
||||
+++ src/sendmail.cc
|
||||
@@ -84,7 +84,7 @@
|
||||
str[varlen] = '=';
|
||||
memcpy(str+varlen+1, val, vallen);
|
||||
str[varlen+vallen+1] = 0;
|
||||
- return putenv(str);
|
||||
+ return putenv(strdup(str));
|
||||
}
|
||||
#endif
|
||||
|
14
mail/nullmailer/files/patch-smtp.cc
Normal file
14
mail/nullmailer/files/patch-smtp.cc
Normal file
|
@ -0,0 +1,14 @@
|
|||
--- protocols/smtp.cc
|
||||
+++ protocols/smtp.cc
|
||||
@@ -120,9 +120,8 @@
|
||||
docmd("DATA", 300);
|
||||
mystring tmp;
|
||||
while(msg->getline(tmp)) {
|
||||
- if((tmp[0] == '.' && tmp[1] == 0 && !(out << ".")) ||
|
||||
- !(out << tmp << "\r\n"))
|
||||
- exit(ERR_MSG_WRITE);
|
||||
+ if(tmp[0] == '.' && !(out << ".")) exit(ERR_MSG_WRITE);
|
||||
+ if(!(out << tmp << "\r\n")) exit(ERR_MSG_WRITE);
|
||||
}
|
||||
docmd(".", 200);
|
||||
}
|
Loading…
Add table
Reference in a new issue