Re-fix live variable $value free. The inital fix resulted in $value from ${run....

being available later, which is a documented feature.

Broken=by: cf3fecb9e873

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index d0f310f574666b7242556093bb0ba29af834d4d9..ffb34e882a15551735ff1a5635fe11383af3e7dc 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -10694,6 +10694,7 @@ shell must be invoked directly, such as with:
 .code
 ${run{/bin/bash -c "/usr/bin/id >/tmp/id"}{yes}{yes}}
 .endd
+Note that &$value$& will not persist beyond the reception of a single message.
 
 .vindex "&$runrc$&"
 The return code from the command is put in the variable &$runrc$&, and this

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index aa1db1dfeeab343520de363c9a538a0030c28c50..948e51d73ba346471a5c8323530ce9693ec03849 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -170,8 +170,8 @@ JH/31 Bug 2998: Fix ${utf8clean:...} to disallow UTF-16 surrogate codepoints.
 JH/32 Fix "tls_dhparam = none" under GnuTLS.  At least with 3.7.9 this gave
       a null-indirection SIGSEGV for the receive process.
 
-JH/33 Fix free for live variable $value created by a ${run ...} expansion.
-      Although not seen, this could have resulted in a SIGSEGV.
+JH/33 Fix free for live variable $value created by a ${run ...} expansion during
+      -bh use.  Internal checking would spot this and take a panic.
 
 JH/34 Bug 3013: Fix use of $recipients within arguments for ${run...}.
       In 4.96 this would expand to empty.

diff --git a/src/src/exim.c b/src/src/exim.c
index c44c7cb1ba799696bb91f53a1d73f34b7a031250..a96d12167d6e7b41149425cb180154f088884523 100644 (file)
--- a/src/src/exim.c
+++ b/src/src/exim.c
@@ -5779,7 +5779,7 @@ for (BOOL more = TRUE; more; )
       int start, end, domain;
       uschar * errmess;
       /* There can be multiple addresses, so EXIM_DISPLAYMAIL_MAX (tuned for 1) is too short.
-       * We'll still want to cap it to something, just in case. */
+      We'll still want to cap it to something, just in case. */
       uschar * s = string_copy_taint(
        exim_str_fail_toolong(list[i], BIG_BUFFER_SIZE, "address argument"),
        GET_TAINTED);
@@ -6114,6 +6114,7 @@ MORELOOP:
   deliver_localpart_data = deliver_domain_data =
   recipient_data = sender_data = NULL;
   acl_var_m = NULL;
+  lookup_value = NULL;                            /* Can be set by ACL */
 
   store_reset(reset_point);
   }

diff --git a/test/confs/0635 b/test/confs/0635
index 2b6a726d1b9732b861deb37761a34f7c70269e82..4aec94e13db37a9e77b3b6e881e82ef738e50442 100644 (file)
--- a/test/confs/0635
+++ b/test/confs/0635
@@ -19,6 +19,7 @@ begin acl
 check_data:
   accept logwrite = \$recipients: "$recipients"
         logwrite = run-wrapped \$recipients: "${run{/bin/echo $recipients}}"
+        logwrite = \$value after \${run...}: '$value'
 
 # ----- Routers -----
 

diff --git a/test/log/0635 b/test/log/0635
index 5126c2c63f79faf9edf26559ea7f7b0ef82e8328..889cfa6510e24520fb2a187fe94b7a2e219c0225 100644 (file)
--- a/test/log/0635
+++ b/test/log/0635
@@ -1,5 +1,6 @@
 1999-03-02 09:44:33 10HmaX-000000005vi-0000 $recipients: "CALLER@the.local.host.name"
 1999-03-02 09:44:33 10HmaX-000000005vi-0000 run-wrapped $recipients: "CALLER@the.local.host.name\n"
+1999-03-02 09:44:33 10HmaX-000000005vi-0000 $value after ${run...}: 'CALLER@the.local.host.name\n'
 1999-03-02 09:44:33 10HmaX-000000005vi-0000 <= someone@some.domain U=CALLER P=local-smtp S=sss
 1999-03-02 09:44:33 10HmaX-000000005vi-0000 => CALLER <CALLER@the.local.host.name> R=localuser T=local_delivery
 1999-03-02 09:44:33 10HmaX-000000005vi-0000 Completed

diff --git a/test/mail/0635.CALLER b/test/mail/0635.CALLER
new file mode 100644 (file)
index 0000000..25b61aa
--- /dev/null
+++ b/test/mail/0635.CALLER
@@ -0,0 +1,13 @@
+From someone@some.domain Tue Mar 02 09:44:33 1999
+Received: from CALLER (helo=test)
+       by the.local.host.name with local-smtp (Exim x.yz)
+       (envelope-from <someone@some.domain>)
+       id 10HmaX-000000005vi-0000
+       for CALLER@the.local.host.name;
+       Tue, 2 Mar 1999 09:44:33 +0000
+Message-Id: <E10HmaX-000000005vi-0000@the.local.host.name>
+From: someone@some.domain
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+
+This is a test message.
+