SECURITY: Don't miss the very last byte when reading long lines from -H
authorHeiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Sat, 21 Nov 2020 21:18:56 +0000 (22:18 +0100)
committerHeiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Thu, 27 May 2021 19:30:35 +0000 (21:30 +0200)
commit5dad84609e49ce4c45d29ccb98b1b7b1f296d69e
tree3cb344b33d73222ad9961a51a9af7c8173cd63e5
parentfa5f51b5b5157e55104bd10d66ccaa066090eec3
SECURITY: Don't miss the very last byte when reading long lines from -H

Credits: Qualys

    2/ In src/spool_in.c:

     462   while (  (len = Ustrlen(big_buffer)) == big_buffer_size-1
     463         && big_buffer[len-1] != '\n'
     464         )
     465     {   /* buffer not big enough for line; certs make this possible */
     466     uschar * buf;
     467     if (big_buffer_size >= BIG_BUFFER_SIZE*4) goto SPOOL_READ_ERROR;
     468     buf = store_get_perm(big_buffer_size *= 2, FALSE);
     469     memcpy(buf, big_buffer, --len);

    The --len in memcpy() chops off a useful byte (we know for sure that
    big_buffer[len-1] is not a '\n' because we entered the while loop).

(cherry picked from commit 58454ea01c2e817481770954edf09ad82f3cd417)
(cherry picked from commit 2d9f1837bdd6c5946cb9cd997544eefc8cc14fc4)
src/src/spool_in.c