CVE-2020-28008: Assorted attacks in Exim's spool directory

[exim.git] / src / src / lookups / dsearch.c

diff --git a/src/src/lookups/dsearch.c b/src/src/lookups/dsearch.c
index c9f088412a74cbeca027e73b9340bdce62197549..501293ac0330c8f58f7778fe082efee6551f8bd1 100644 (file)
--- a/src/src/lookups/dsearch.c
+++ b/src/src/lookups/dsearch.c
@@ -3,6 +3,7 @@
 *************************************************/
 
 /* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) The Exim Maintainers 2020 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* The idea for this code came from Matthew Byng-Maddick, but his original has
@@ -124,8 +125,7 @@ if (  Ulstat(filename, &statbuf) >= 0
                 && S_ISDIR(statbuf.st_mode)
         && (  flags & FILTER_DIR
            || keystring[0] != '.'
-           || keystring[1] != '.'
-           || keystring[1] && keystring[2]
+           || keystring[1] && keystring[1] != '.'
    )  )  )  )
   {
   /* Since the filename exists in the filesystem, we can return a
@@ -134,10 +134,10 @@ if (  Ulstat(filename, &statbuf) >= 0
   return OK;
   }
 
-if (errno == ENOENT) return FAIL;
+if (errno == ENOENT || errno == 0) return FAIL;
 
 save_errno = errno;
-*errmsg = string_sprintf("%s: lstat failed", filename);
+*errmsg = string_sprintf("%s: lstat: %s", filename, strerror(errno));
 errno = save_errno;
 return DEFER;
 }