redirect router: taint-enforce filenames

[exim.git] / src / src / string.c

diff --git a/src/src/string.c b/src/src/string.c
index a954396512723624ff777e457789e84f9dfd1641..fbdc0246d48f591f09a3952801f6b274870a9a0a 100644 (file)
--- a/src/src/string.c
+++ b/src/src/string.c
@@ -411,7 +411,8 @@ return ss;
 
 
 
-#ifdef HAVE_LOCAL_SCAN
+#if (defined(HAVE_LOCAL_SCAN) || defined(EXPAND_DLFUNC)) \
+       && !defined(MACRO_PREDEF) && !defined(COMPILE_UTILITY)
 /*************************************************
 *            Copy and save string                *
 *************************************************/
@@ -432,7 +433,7 @@ As above, but explicitly specifying the result taint status
 */
 
 uschar *
-string_copy_taint(const uschar * s, BOOL tainted)
+string_copy_taint_function(const uschar * s, BOOL tainted)
 {
 int len = Ustrlen(s) + 1;
 uschar *ss = store_get(len, tainted);
@@ -664,7 +665,7 @@ return yield;
 *************************************************/
 
 /* The formatting is done by string_vformat, which checks the length of
-everything.
+everything.  Taint is taken from the worst of the arguments.
 
 Arguments:
   format    a printf() format - deliberately char * rather than uschar *
@@ -677,12 +678,20 @@ Returns:    pointer to fresh piece of store containing sprintf'ed string
 uschar *
 string_sprintf_trc(const char *format, const uschar * func, unsigned line, ...)
 {
-gstring * g;
-va_list ap;
+#ifdef COMPILE_UTILITY
+uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
+gstring gs = { .size = STRING_SPRINTF_BUFFER_SIZE, .ptr = 0, .s = buffer };
+gstring * g = &gs;
+unsigned flags = 0;
+#else
+gstring * g = NULL;
+unsigned flags = SVFMT_REBUFFER|SVFMT_EXTEND;
+#endif
 
+va_list ap;
 va_start(ap, line);
-g = string_vformat_trc(NULL, func, line, STRING_SPRINTF_BUFFER_SIZE,
-       SVFMT_REBUFFER|SVFMT_EXTEND, format, ap);
+g = string_vformat_trc(g, func, line, STRING_SPRINTF_BUFFER_SIZE,
+       flags, format, ap);
 va_end(ap);
 
 if (!g)
@@ -691,8 +700,12 @@ if (!g)
     " called from %s %d\n",
     STRING_SPRINTF_BUFFER_SIZE, format, func, line);
 
+#ifdef COMPILE_UTILITY
+return string_copyn(g->s, g->ptr);
+#else
 gstring_release_unused(g);
 return string_from_gstring(g);
+#endif
 }
 
 
@@ -1251,8 +1264,8 @@ If the "extend" flag is false, the string passed in may not be NULL,
 will not be grown, and is usable in the original place after return.
 The return value can be NULL to signify overflow.
 
-Returns the possibly-new (if copy for growth was needed) string,
-not nul-terminated.
+Returns the possibly-new (if copy for growth or taint-handling was needed)
+string, not nul-terminated.
 */
 
 gstring *