66 lines
2.3 KiB
Diff
66 lines
2.3 KiB
Diff
|
Fix CVE-2017-16943:
|
||
|
|
|
||
|
|
https://bugs.exim.org/show_bug.cgi?id=2199
|
||
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16943
|
||
|
|
|
||
|
|
Patch copied from upstream source repository:
|
||
|
|
|
||
|
|
https://git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bde
|
||
|
|
|
||
|
|
From 4090d62a4b25782129cc1643596dc2f6e8f63bde Mon Sep 17 00:00:00 2001
|
||
|
|
From: Jeremy Harris <jgh146exb@wizmail.org>
|
||
|
|
Date: Fri, 24 Nov 2017 20:22:33 +0000
|
||
|
|
Subject: [PATCH] Avoid release of store if there have been later allocations.
|
||
|
|
Bug 2199
|
||
|
|
|
||
|
|
---
|
||
|
|
doc/doc-txt/ChangeLog | 4 ++++
|
||
|
|
src/src/receive.c | 7 ++++---
|
||
|
|
2 files changed, 8 insertions(+), 3 deletions(-)
|
||
|
|
|
||
|
|
#diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
|
||
|
|
#index e937ba2..a2d9339 100644
|
||
|
|
#--- a/doc/doc-txt/ChangeLog
|
||
|
|
#+++ b/doc/doc-txt/ChangeLog
|
||
|
|
#@@ -59,6 +59,10 @@ JH/30 Fix a logging bug on aarch64: an unsafe routine was previously used for
|
||
|
|
# connection in response to HELO" was logged instead of the actual 4xx
|
||
|
|
# error for the HELO.
|
||
|
|
#
|
||
|
|
#+JH/34 Bug 2199: fix a use-after-free while reading smtp input for header lines.
|
||
|
|
#+ A crafted sequence of BDAT commands could result in in-use memory beeing
|
||
|
|
#+ freed.
|
||
|
|
#+
|
||
|
|
#
|
||
|
|
Exim version 4.89
|
||
|
|
-----------------
|
||
|
|
diff --git a/src/src/receive.c b/src/src/receive.c
|
||
|
|
index 95cf13e..20672db 100644
|
||
|
|
--- a/src/receive.c
|
||
|
|
+++ b/src/receive.c
|
||
|
|
@@ -1772,8 +1772,8 @@ for (;;)
|
||
|
|
(and sometimes lunatic messages can have ones that are 100s of K long) we
|
||
|
|
call store_release() for strings that have been copied - if the string is at
|
||
|
|
the start of a block (and therefore the only thing in it, because we aren't
|
||
|
|
- doing any other gets), the block gets freed. We can only do this because we
|
||
|
|
- know there are no other calls to store_get() going on. */
|
||
|
|
+ doing any other gets), the block gets freed. We can only do this release if
|
||
|
|
+ there were no allocations since the once that we want to free. */
|
||
|
|
|
||
|
|
if (ptr >= header_size - 4)
|
||
|
|
{
|
||
|
|
@@ -1782,9 +1782,10 @@ for (;;)
|
||
|
|
header_size *= 2;
|
||
|
|
if (!store_extend(next->text, oldsize, header_size))
|
||
|
|
{
|
||
|
|
+ BOOL release_ok = store_last_get[store_pool] == next->text;
|
||
|
|
uschar *newtext = store_get(header_size);
|
||
|
|
memcpy(newtext, next->text, ptr);
|
||
|
|
- store_release(next->text);
|
||
|
|
+ if (release_ok) store_release(next->text);
|
||
|
|
next->text = newtext;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
--
|
||
|
|
1.9.1
|
||
|
|
|