Fix CVE-2016-1531

[exim.git] / src / src / dbfn.c

diff --git a/src/src/dbfn.c b/src/src/dbfn.c
index d46ad247afdafc388bdb7e5810bcfd1b477ba1d4..f521f2c20e321f9837eb3ec2df2449d0b2a6d97f 100644 (file)
--- a/src/src/dbfn.c
+++ b/src/src/dbfn.c
@@ -1,10 +1,8 @@
-/* $Cambridge: exim/src/src/dbfn.c,v 1.6 2005/06/27 14:29:43 ph10 Exp $ */
-

 /*************************************************
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 

-/* Copyright (c) University of Cambridge 1995 - 2005 */
+/* Copyright (c) University of Cambridge 1995 - 2015 */

 /* See the file NOTICE for conditions of use and distribution. */
 
 
 /* See the file NOTICE for conditions of use and distribution. */
 
 


@@ -80,6 +78,10 @@ Returns:   NULL if the open failed, or the locking failed. After locking
 
            On success, dbblock is returned. This contains the dbm pointer and
            the fd of the locked lock file.
 
            On success, dbblock is returned. This contains the dbm pointer and
            the fd of the locked lock file.

+
+There are some calls that use O_RDWR|O_CREAT for the flags. Having discovered
+this in December 2005, I'm not sure if this is correct or not, but for the
+moment I haven't changed them.

 */
 
 open_db *
 */
 
 open_db *


@@ -138,8 +140,8 @@ alarm(0);
 if (sigalrm_seen) errno = ETIMEDOUT;
 if (rc < 0)
   {
 if (sigalrm_seen) errno = ETIMEDOUT;
 if (rc < 0)
   {

-  log_write(0, LOG_MAIN, "Failed to get %s lock for %s: %s",
-    ((flags & O_RDONLY) != 0)? "read" : "write", buffer,
+  log_write(0, LOG_MAIN|LOG_PANIC, "Failed to get %s lock for %s: %s",
+    read_only? "read" : "write", buffer,

     (errno == ETIMEDOUT)? "timed out" : strerror(errno));
   (void)close(dbblock->lockfd);
   errno = 0;       /* Indicates locking failure */
     (errno == ETIMEDOUT)? "timed out" : strerror(errno));
   (void)close(dbblock->lockfd);
   errno = 0;       /* Indicates locking failure */


@@ -206,7 +208,8 @@ if (created && geteuid() == root_uid)
       if (Ustat(buffer, &statbuf) >= 0 && statbuf.st_uid != exim_uid)
         {
         DEBUG(D_hints_lookup) debug_printf("ensuring %s is owned by exim\n", buffer);
       if (Ustat(buffer, &statbuf) >= 0 && statbuf.st_uid != exim_uid)
         {
         DEBUG(D_hints_lookup) debug_printf("ensuring %s is owned by exim\n", buffer);

-        (void)Uchown(buffer, exim_uid, exim_gid);
+        if (Uchown(buffer, exim_uid, exim_gid))
+          DEBUG(D_hints_lookup) debug_printf("failed setting %s to owned by exim\n", buffer);

         }
       }
     }
         }
       }
     }


@@ -235,7 +238,9 @@ if (dbblock->dbptr == NULL)
   }
 
 DEBUG(D_hints_lookup)
   }
 
 DEBUG(D_hints_lookup)

-  debug_printf("opened hints database %s: flags=%x\n", buffer, flags);
+  debug_printf("opened hints database %s: flags=%s\n", buffer,
+    (flags == O_RDONLY)? "O_RDONLY" : (flags == O_RDWR)? "O_RDWR" :
+    (flags == (O_RDWR|O_CREAT))? "O_RDWR|O_CREAT" : "??");

 
 /* Pass back the block containing the opened database handle and the open fd
 for the lock. */
 
 /* Pass back the block containing the opened database handle and the open fd
 for the lock. */


@@ -289,17 +294,21 @@ Returns: a pointer to the retrieved record, or
 */
 
 void *
 */
 
 void *

-dbfn_read_with_length(open_db *dbblock, uschar *key, int *length)
+dbfn_read_with_length(open_db *dbblock, const uschar *key, int *length)

 {
 void *yield;
 EXIM_DATUM key_datum, result_datum;
 {
 void *yield;
 EXIM_DATUM key_datum, result_datum;

+int klen = Ustrlen(key) + 1;
+uschar * key_copy = store_get(klen);
+
+memcpy(key_copy, key, klen);

 
 DEBUG(D_hints_lookup) debug_printf("dbfn_read: key=%s\n", key);
 
 EXIM_DATUM_INIT(key_datum);         /* Some DBM libraries require the datum */
 EXIM_DATUM_INIT(result_datum);      /* to be cleared before use. */
 
 DEBUG(D_hints_lookup) debug_printf("dbfn_read: key=%s\n", key);
 
 EXIM_DATUM_INIT(key_datum);         /* Some DBM libraries require the datum */
 EXIM_DATUM_INIT(result_datum);      /* to be cleared before use. */

-EXIM_DATUM_DATA(key_datum) = CS key;
-EXIM_DATUM_SIZE(key_datum) = Ustrlen(key) + 1;
+EXIM_DATUM_DATA(key_datum) = CS key_copy;
+EXIM_DATUM_SIZE(key_datum) = klen;

 
 if (!EXIM_DBGET(dbblock->dbptr, key_datum, result_datum)) return NULL;
 
 
 if (!EXIM_DBGET(dbblock->dbptr, key_datum, result_datum)) return NULL;
 


@@ -329,18 +338,22 @@ Returns:    the yield of the underlying dbm or db "write" function. If this
 */
 
 int
 */
 
 int

-dbfn_write(open_db *dbblock, uschar *key, void *ptr, int length)
+dbfn_write(open_db *dbblock, const uschar *key, void *ptr, int length)

 {
 EXIM_DATUM key_datum, value_datum;
 dbdata_generic *gptr = (dbdata_generic *)ptr;
 {
 EXIM_DATUM key_datum, value_datum;
 dbdata_generic *gptr = (dbdata_generic *)ptr;

+int klen = Ustrlen(key) + 1;
+uschar * key_copy = store_get(klen);
+
+memcpy(key_copy, key, klen);

 gptr->time_stamp = time(NULL);
 
 DEBUG(D_hints_lookup) debug_printf("dbfn_write: key=%s\n", key);
 
 EXIM_DATUM_INIT(key_datum);         /* Some DBM libraries require the datum */
 EXIM_DATUM_INIT(value_datum);       /* to be cleared before use. */
 gptr->time_stamp = time(NULL);
 
 DEBUG(D_hints_lookup) debug_printf("dbfn_write: key=%s\n", key);
 
 EXIM_DATUM_INIT(key_datum);         /* Some DBM libraries require the datum */
 EXIM_DATUM_INIT(value_datum);       /* to be cleared before use. */

-EXIM_DATUM_DATA(key_datum) = CS key;
-EXIM_DATUM_SIZE(key_datum) = Ustrlen(key) + 1;
+EXIM_DATUM_DATA(key_datum) = CS key_copy;
+EXIM_DATUM_SIZE(key_datum) = klen;

 EXIM_DATUM_DATA(value_datum) = CS ptr;
 EXIM_DATUM_SIZE(value_datum) = length;
 return EXIM_DBPUT(dbblock->dbptr, key_datum, value_datum);
 EXIM_DATUM_DATA(value_datum) = CS ptr;
 EXIM_DATUM_SIZE(value_datum) = length;
 return EXIM_DBPUT(dbblock->dbptr, key_datum, value_datum);


@@ -361,12 +374,16 @@ Returns: the yield of the underlying dbm or db "delete" function.
 */
 
 int
 */
 
 int

-dbfn_delete(open_db *dbblock, uschar *key)
+dbfn_delete(open_db *dbblock, const uschar *key)

 {
 {

+int klen = Ustrlen(key) + 1;
+uschar * key_copy = store_get(klen);
+
+memcpy(key_copy, key, klen);

 EXIM_DATUM key_datum;
 EXIM_DATUM_INIT(key_datum);         /* Some DBM libraries require clearing */
 EXIM_DATUM key_datum;
 EXIM_DATUM_INIT(key_datum);         /* Some DBM libraries require clearing */

-EXIM_DATUM_DATA(key_datum) = CS key;
-EXIM_DATUM_SIZE(key_datum) = Ustrlen(key) + 1;
+EXIM_DATUM_DATA(key_datum) = CS key_copy;
+EXIM_DATUM_SIZE(key_datum) = klen;

 return EXIM_DBDEL(dbblock->dbptr, key_datum);
 }
 
 return EXIM_DBDEL(dbblock->dbptr, key_datum);
 }