Taint: check on supplied buffer vs. list when extracting elements

[exim.git] / src / src / host.c

diff --git a/src/src/host.c b/src/src/host.c
index 3361d59123f33314ba79f70c0ac562513da99b4c..1426bff9752de73b51c92a63dbcece9a1b054396 100644 (file)
--- a/src/src/host.c
+++ b/src/src/host.c
@@ -729,6 +729,7 @@ host_build_ifacelist(const uschar *list, uschar *name)
 int sep = 0;
 uschar *s;
 ip_address_item * yield = NULL, * last = NULL, * next;
+BOOL taint = is_tainted(list);
 
 while ((s = string_nextinlist(&list, &sep, NULL, 0)))
   {
@@ -747,7 +748,7 @@ while ((s = string_nextinlist(&list, &sep, NULL, 0)))
   address above. The field in the ip_address_item is large enough to hold an
   IPv6 address. */
 
-  next = store_get(sizeof(ip_address_item), FALSE);
+  next = store_get(sizeof(ip_address_item), taint);
   next->next = NULL;
   Ustrcpy(next->address, s);
   next->port = port;