Fix ${listextract } from a tainted list

[exim.git] / src / src / expand.c

diff --git a/src/src/expand.c b/src/src/expand.c
index 21758d832c559aae546d484273e3174bf21db405..839821ef7e4ebbff6b44a4ad74d1463ec1cb0f13 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -1298,15 +1298,16 @@ expand_getlistele(int field, const uschar * list)
 {
 const uschar * tlist = list;
 int sep = 0;
-uschar dummy;
+/* Tainted mem for the throwaway element copies */
+uschar * dummy = store_get(2, TRUE);
 
 if (field < 0)
   {
-  for (field++; string_nextinlist(&tlist, &sep, &dummy, 1); ) field++;
+  for (field++; string_nextinlist(&tlist, &sep, dummy, 1); ) field++;
   sep = 0;
   }
 if (field == 0) return NULL;
-while (--field > 0 && (string_nextinlist(&list, &sep, &dummy, 1))) ;
+while (--field > 0 && (string_nextinlist(&list, &sep, dummy, 1))) ;
 return string_nextinlist(&list, &sep, NULL, 0);
 }