Hints DB: harden against corrupt files by ignoring unexpected size records

[exim.git] / src / src / dbfn.c

diff --git a/src/src/dbfn.c b/src/src/dbfn.c
index 63a1aefe353818ea385feee3b6700828fc5e05e5..452e2ade6a0330fc96256188dbaf7086768806f6 100644 (file)
--- a/src/src/dbfn.c
+++ b/src/src/dbfn.c
@@ -3,6 +3,7 @@
 *************************************************/
 
 /* Copyright (c) University of Cambridge 1995 - 2018 */
+/* Copyright (c) The Exim Maintainers 2020 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -122,7 +123,7 @@ if ((dbblock->lockfd = Uopen(filename, O_RDWR, EXIMDB_LOCKFILE_MODE)) < 0)
 if (dbblock->lockfd < 0)
   {
   log_write(0, LOG_MAIN, "%s",
-    string_open_failed(errno, "database lock file %s", filename));
+    string_open_failed("database lock file %s", filename));
   errno = 0;      /* Indicates locking failure */
   DEBUG(D_hints_lookup) acl_level--;
   return NULL;
@@ -194,26 +195,29 @@ but creation of the database file failed. */
 
 if (created && geteuid() == root_uid)
   {
-  DIR *dd;
-  struct dirent *ent;
+  DIR * dd;
   uschar *lastname = Ustrrchr(filename, '/') + 1;
   int namelen = Ustrlen(name);
 
   *lastname = 0;
-  dd = opendir(CS filename);
 
-  while ((ent = readdir(dd)))
-    if (Ustrncmp(ent->d_name, name, namelen) == 0)
-      {
-      struct stat statbuf;
-      Ustrcpy(lastname, US ent->d_name);
-      if (Ustat(filename, &statbuf) >= 0 && statbuf.st_uid != exim_uid)
-        {
-        DEBUG(D_hints_lookup) debug_printf_indent("ensuring %s is owned by exim\n", filename);
-        if (exim_chown(filename, exim_uid, exim_gid))
-          DEBUG(D_hints_lookup) debug_printf_indent("failed setting %s to owned by exim\n", filename);
-        }
-      }
+  if ((dd = exim_opendir(filename)))
+    for (struct dirent *ent; ent = readdir(dd); )
+      if (Ustrncmp(ent->d_name, name, namelen) == 0)
+       {
+       struct stat statbuf;
+       /* Filenames from readdir() are trusted,
+       so use a taint-nonchecking copy */
+       strcpy(CS lastname, CCS ent->d_name);
+       if (Ustat(filename, &statbuf) >= 0 && statbuf.st_uid != exim_uid)
+         {
+         DEBUG(D_hints_lookup)
+           debug_printf_indent("ensuring %s is owned by exim\n", filename);
+         if (exim_chown(filename, exim_uid, exim_gid))
+           DEBUG(D_hints_lookup)
+             debug_printf_indent("failed setting %s to owned by exim\n", filename);
+         }
+       }
 
   closedir(dd);
   }
@@ -224,12 +228,13 @@ exist. */
 
 if (!dbblock->dbptr)
   {
+  errno = save_errno;
   if (lof && save_errno != ENOENT)
-    log_write(0, LOG_MAIN, "%s", string_open_failed(save_errno, "DB file %s",
+    log_write(0, LOG_MAIN, "%s", string_open_failed("DB file %s",
         filename));
   else
     DEBUG(D_hints_lookup)
-      debug_printf_indent("%s\n", CS string_open_failed(save_errno, "DB file %s",
+      debug_printf_indent("%s\n", CS string_open_failed("DB file %s",
           filename));
   (void)close(dbblock->lockfd);
   errno = save_errno;
@@ -328,6 +333,34 @@ return yield;
 }
 
 
+/* Read a record.  If the length is not as expected then delete it, write
+an error log line and return NULL.
+Use this for fixed-size records (so not retry or wait records).
+
+Arguments:
+  dbblock   a pointer to an open database block
+  key       the key of the record to be read
+  length    the expected record length
+
+Returns: a pointer to the retrieved record, or
+         NULL if the record is not found/bad
+*/
+
+void *
+dbfn_read_enforce_length(open_db * dbblock, const uschar * key, size_t length)
+{
+int rlen;
+void * yield = dbfn_read_with_length(dbblock, key, &rlen);
+
+if (yield)
+  {
+  if (rlen == length) return yield;
+  log_write(0, LOG_MAIN|LOG_PANIC, "Bad db record size for '%s'", key);
+  dbfn_delete(dbblock, key);
+  }
+return NULL;
+}
+
 
 /*************************************************
 *             Write to database file             *
@@ -419,7 +452,6 @@ dbfn_scan(open_db *dbblock, BOOL start, EXIM_CURSOR **cursor)
 {
 EXIM_DATUM key_datum, value_datum;
 uschar *yield;
-value_datum = value_datum;    /* dummy; not all db libraries use this */
 
 DEBUG(D_hints_lookup) debug_printf_indent("dbfn_scan\n");