SECURITY: off-by-one in smtp transport (read response)

[exim.git] / src / src / regex.c

diff --git a/src/src/regex.c b/src/src/regex.c
index 3852ad8c52a68427651bd4b9708cb54b03aab6ff..f9c06b9e3dde9e26ba87741db92662d3310e584c 100644 (file)
--- a/src/src/regex.c
+++ b/src/src/regex.c
@@ -2,8 +2,10 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 

-/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003-2015 */
-/* License: GPL */
+/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003-2015
+ * License: GPL
+ * Copyright (c) The Exim Maintainers 2016 - 2018
+ */

 
 /* Code for matching regular expressions against headers and body.
  Called from acl.c. */
 
 /* Code for matching regular expressions against headers and body.
  Called from acl.c. */


@@ -51,7 +53,7 @@ while ((regex_string = string_nextinlist(&list, &sep, NULL, 0)))
       continue;
       }
 
       continue;
       }
 

-    ri = store_get(sizeof(pcre_list));
+    ri = store_get(sizeof(pcre_list), FALSE);

     ri->re = re;
     ri->pcre_text = regex_string;
     ri->next = re_list_head;
     ri->re = re;
     ri->pcre_text = regex_string;
     ri->next = re_list_head;


@@ -63,22 +65,19 @@ return re_list_head;
 static int
 matcher(pcre_list * re_list_head, uschar * linebuffer, int len)
 {
 static int
 matcher(pcre_list * re_list_head, uschar * linebuffer, int len)
 {

-pcre_list * ri;
-
-for(ri = re_list_head; ri; ri = ri->next)
+for(pcre_list * ri = re_list_head; ri; ri = ri->next)

   {
   int ovec[3*(REGEX_VARS+1)];
   {
   int ovec[3*(REGEX_VARS+1)];

-  int n, nn;
+  int n;

 
   /* try matcher on the line */
 
   /* try matcher on the line */

-  n = pcre_exec(ri->re, NULL, CS linebuffer, len, 0, 0, ovec, nelem(ovec));
-  if (n > 0)
+  if ((n = pcre_exec(ri->re, NULL, CS linebuffer, len, 0, 0, ovec, nelem(ovec))) > 0)

     {
     Ustrncpy(regex_match_string_buffer, ri->pcre_text,
              sizeof(regex_match_string_buffer)-1);
     regex_match_string = regex_match_string_buffer;
 
     {
     Ustrncpy(regex_match_string_buffer, ri->pcre_text,
              sizeof(regex_match_string_buffer)-1);
     regex_match_string = regex_match_string_buffer;
 

-    for (nn = 1; nn < n; nn++)
+    for (int nn = 1; nn < n; nn++)

       regex_vars[nn-1] =
        string_copyn(linebuffer + ovec[nn*2], ovec[nn*2+1] - ovec[nn*2]);
 
       regex_vars[nn-1] =
        string_copyn(linebuffer + ovec[nn*2], ovec[nn*2+1] - ovec[nn*2]);
 


@@ -103,7 +102,7 @@ regex_match_string = NULL;
 
 if (!mime_stream)                              /* We are in the DATA ACL */
   {
 
 if (!mime_stream)                              /* We are in the DATA ACL */
   {

-  if (!(mbox_file = spool_mbox(&mbox_size, NULL)))
+  if (!(mbox_file = spool_mbox(&mbox_size, NULL, NULL)))

     {                                          /* error while spooling */
     log_write(0, LOG_MAIN|LOG_PANIC,
           "regex acl condition: error while creating mbox spool file");
     {                                          /* error while spooling */
     log_write(0, LOG_MAIN|LOG_PANIC,
           "regex acl condition: error while creating mbox spool file");


@@ -112,7 +111,12 @@ if (!mime_stream)                          /* We are in the DATA ACL */
   }
 else
   {
   }
 else
   {

-  f_pos = ftell(mime_stream);
+  if ((f_pos = ftell(mime_stream)) < 0)
+    {
+    log_write(0, LOG_MAIN|LOG_PANIC,
+          "regex acl condition: mime_stream: %s", strerror(errno));
+    return DEFER;
+    }

   mbox_file = mime_stream;
   }
 
   mbox_file = mime_stream;
   }
 


@@ -121,7 +125,7 @@ if (!(re_list_head = compile(*listptr)))
   return FAIL;                 /* no regexes -> nothing to do */
 
 /* match each line against all regexes */
   return FAIL;                 /* no regexes -> nothing to do */
 
 /* match each line against all regexes */

-linebuffer = store_get(32767);
+linebuffer = store_get(32767, TRUE);   /* tainted */

 while (fgets(CS linebuffer, 32767, mbox_file))
   {
   if (  mime_stream && mime_current_boundary           /* check boundary */
 while (fgets(CS linebuffer, 32767, mbox_file))
   {
   if (  mime_stream && mime_current_boundary           /* check boundary */


@@ -141,7 +145,12 @@ if (!mime_stream)
 else
   {
   clearerr(mime_stream);
 else
   {
   clearerr(mime_stream);

-  fseek(mime_stream, f_pos, SEEK_SET);
+  if (fseek(mime_stream, f_pos, SEEK_SET) == -1)
+    {
+    log_write(0, LOG_MAIN|LOG_PANIC,
+          "regex acl condition: mime_stream: %s", strerror(errno));
+    clearerr(mime_stream);
+    }

   }
 
 return ret;
   }
 
 return ret;


@@ -186,8 +195,8 @@ if (!(f = fopen(CS mime_decoded_filename, "rb")))
   return DEFER;
   }
 
   return DEFER;
   }
 

-/* get 32k memory */
-mime_subject = store_get(32767);
+/* get 32k memory, tainted */
+mime_subject = store_get(32767, TRUE);

 
 mime_subject_len = fread(mime_subject, 1, 32766, f);
 
 
 mime_subject_len = fread(mime_subject, 1, 32766, f);