X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/3634fc257bd0667daef14d72005cd87c735bbb24..3386088d5af4d4c61faa12ae29560e2c5bd43304:/src/src/dkim.c

diff --git a/src/src/dkim.c b/src/src/dkim.c
index 87e91dea2..3e7154525 100644
--- a/src/src/dkim.c
+++ b/src/src/dkim.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge, 1995 - 2007 */
+/* Copyright (c) University of Cambridge, 1995 - 2015 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Code for DKIM support. Other DKIM relevant code is in
@@ -23,6 +23,7 @@ int dkim_exim_query_dns_txt(char *name, char *answer) {
   dns_scan   dnss;
   dns_record *rr;
 
+  lookup_dnssec_authenticated = NULL;
   if (dns_lookup(&dnsa, (uschar *)name, T_TXT, NULL) != DNS_SUCCEED) return PDKIM_FAIL;
 
   /* Search for TXT record */
@@ -42,6 +43,9 @@ int dkim_exim_query_dns_txt(char *name, char *answer) {
                "%.*s", (int)len, (char *)((rr->data)+rr_offset));
       rr_offset+=len;
       answer_offset+=len;
+      if (answer_offset >= PDKIM_DNS_TXT_MAX_RECLEN) {
+        return PDKIM_FAIL;
+      }
     }
   }
   else return PDKIM_FAIL;
@@ -379,12 +383,11 @@ uschar *dkim_exim_expand_defaults(int what) {
 }
 
 
-uschar *dkim_exim_sign(int dkim_fd,
-                       uschar *dkim_private_key,
-                       uschar *dkim_domain,
-                       uschar *dkim_selector,
-                       uschar *dkim_canon,
-                       uschar *dkim_sign_headers) {
+uschar *
+dkim_exim_sign(int dkim_fd, uschar *dkim_private_key,
+       const uschar *dkim_domain, uschar *dkim_selector,
+       uschar *dkim_canon, uschar *dkim_sign_headers)
+{
   int sep = 0;
   uschar *seen_items = NULL;
   int seen_items_size = 0;
@@ -408,7 +411,7 @@ uschar *dkim_exim_sign(int dkim_fd,
 
   store_pool = POOL_MAIN;
 
-  dkim_domain = expand_string(dkim_domain);
+  dkim_domain = expand_cstring(dkim_domain);
   if (dkim_domain == NULL) {
     /* expansion error, do not send message. */
     log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
@@ -425,7 +428,7 @@ uschar *dkim_exim_sign(int dkim_fd,
     /* Only sign once for each domain, no matter how often it
        appears in the expanded list. */
     if (seen_items != NULL) {
-      uschar *seen_items_list = seen_items;
+      const uschar *seen_items_list = seen_items;
       if (match_isinlist(dkim_signing_domain,
                          &seen_items_list,0,NULL,NULL,MCL_STRING,TRUE,NULL) == OK)
         continue;
@@ -501,7 +504,12 @@ uschar *dkim_exim_sign(int dkim_fd,
         rc = NULL;
         goto CLEANUP;
       }
-      (void)read(privkey_fd,big_buffer,(big_buffer_size-2));
+      if (read(privkey_fd,big_buffer,(big_buffer_size-2)) < 0) {
+        log_write(0, LOG_MAIN|LOG_PANIC, "unable to read private key file: %s",
+	  dkim_private_key_expanded);
+        rc = NULL;
+        goto CLEANUP;
+      }
       (void)close(privkey_fd);
       dkim_private_key_expanded = big_buffer;
     }