Panic-die if a system filter or router generates more then 32767 child

addresses.

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 8c606107d86a6bcba170e07c63292652e738a743..fbe0549c8eeabe0b574e84fd75f87136da437ed9 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -1,4 +1,4 @@
-$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.449 2006/12/24 12:12:05 magnus Exp $
+$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.450 2007/01/02 11:25:00 ph10 Exp $

 
 Change log file for Exim from version 4.21
 -------------------------------------------
 
 Change log file for Exim from version 4.21
 -------------------------------------------


@@ -14,6 +14,13 @@ MH/01 Don't check that the operands of numeric comparison operators are
       integers when their expansion is in "skipping" mode (fixes bug
       introduced by 4.64-PH/07).
 
       integers when their expansion is in "skipping" mode (fixes bug
       introduced by 4.64-PH/07).
 

+PH/01 If a system filter or a router generates more than SHRT_MAX (32767)
+      child addresses, Exim now panics and dies. Previously, because the count
+      is held in a short int, deliveries were likely to be lost. As such a
+      large number of recipients for a single message is ridiculous
+      (performance will be very, very poor), I have chosen to impose a limit
+      rather than extend the field.
+

 
 Exim version 4.64
 -----------------
 
 Exim version 4.64
 -----------------

diff --git a/src/src/deliver.c b/src/src/deliver.c
index 02552317a5e0ce2083aa814026898facf32aa51f..6154085edb1d28d926885675897846d1770234c6 100644 (file)
--- a/src/src/deliver.c
+++ b/src/src/deliver.c
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/deliver.c,v 1.38 2006/11/06 15:50:12 ph10 Exp $ */
+/* $Cambridge: exim/src/src/deliver.c,v 1.39 2007/01/02 11:25:00 ph10 Exp $ */

 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *


@@ -4941,6 +4941,9 @@ else if (system_filter != NULL && process_recipients != RECIP_FAIL_TIMEOUT)
 
     while (p != NULL)
       {
 
     while (p != NULL)
       {

+      if (parent->child_count == SHRT_MAX)
+        log_write(0, LOG_MAIN|LOG_PANIC_DIE, "system filter generated more "
+          "than %d delivery addresses", SHRT_MAX);

       parent->child_count++;
       p->parent = parent;
 
       parent->child_count++;
       p->parent = parent;
 

diff --git a/src/src/exim.h b/src/src/exim.h
index 59143431258a37ab3868e40b18c0198c83813c35..9882ab3483c0763c59d6c6fe1bb09b5236a49180 100644 (file)
--- a/src/src/exim.h
+++ b/src/src/exim.h
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/exim.h,v 1.19 2006/02/07 11:19:00 ph10 Exp $ */
+/* $Cambridge: exim/src/src/exim.h,v 1.20 2007/01/02 11:25:00 ph10 Exp $ */

 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *


@@ -75,6 +75,14 @@ making unique names. */
 #define INT_MAX 2147483647
 #endif
 
 #define INT_MAX 2147483647
 #endif
 

+#ifndef INT_MIN
+#define INT_MIN (-INT_MAX - 1)
+#endif
+
+#ifndef SHRT_MAX
+#define SHRT_MAX 32767
+#endif
+

 #ifndef UCHAR_MAX
 #define UCHAR_MAX 255
 #endif
 #ifndef UCHAR_MAX
 #define UCHAR_MAX 255
 #endif

diff --git a/src/src/routers/iplookup.c b/src/src/routers/iplookup.c
index 069c0dda1a333aa873d62e2968099cadc6602514..a0afa9d0ab175e1d7d7f95cf51efac8ea4ee5814 100644 (file)
--- a/src/src/routers/iplookup.c
+++ b/src/src/routers/iplookup.c
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/routers/iplookup.c,v 1.8 2006/10/09 14:36:25 ph10 Exp $ */
+/* $Cambridge: exim/src/src/routers/iplookup.c,v 1.9 2007/01/02 11:25:00 ph10 Exp $ */

 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *


@@ -378,6 +378,9 @@ new_addr->parent = addr;
 copyflag(new_addr, addr, af_propagate);
 new_addr->p = addr->p;
 
 copyflag(new_addr, addr, af_propagate);
 new_addr->p = addr->p;
 

+if (addr->child_count == SHRT_MAX)
+  log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s router generated more than %d "
+    "child addresses for <%s>", rblock->name, SHRT_MAX, addr->address);

 addr->child_count++;
 new_addr->next = *addr_new;
 *addr_new = new_addr;
 addr->child_count++;
 new_addr->next = *addr_new;
 *addr_new = new_addr;

diff --git a/src/src/routers/queryprogram.c b/src/src/routers/queryprogram.c
index 1b974fc4eff44fb2fd51f825331fb5587358a4ca..ef3ae8e28ac9b1a0ae7a3431489f35ea43a246a4 100644 (file)
--- a/src/src/routers/queryprogram.c
+++ b/src/src/routers/queryprogram.c
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/routers/queryprogram.c,v 1.8 2006/02/07 14:05:17 ph10 Exp $ */
+/* $Cambridge: exim/src/src/routers/queryprogram.c,v 1.9 2007/01/02 11:25:00 ph10 Exp $ */

 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *


@@ -122,6 +122,9 @@ while (generated != NULL)
   next->next = *addr_new;
   *addr_new = next;
 
   next->next = *addr_new;
   *addr_new = next;
 

+  if (addr->child_count == SHRT_MAX)
+    log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s router generated more than %d "
+      "child addresses for <%s>", rblock->name, SHRT_MAX, addr->address);

   addr->child_count++;
 
   DEBUG(D_route)
   addr->child_count++;
 
   DEBUG(D_route)

diff --git a/src/src/routers/redirect.c b/src/src/routers/redirect.c
index e22699216ec790d8ab93c4287e903a9fc9335c46..2c515d8facca8642e2fbd6e5cf4cc6783592e640 100644 (file)
--- a/src/src/routers/redirect.c
+++ b/src/src/routers/redirect.c
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/routers/redirect.c,v 1.18 2006/11/20 11:43:40 ph10 Exp $ */
+/* $Cambridge: exim/src/src/routers/redirect.c,v 1.19 2007/01/02 11:25:00 ph10 Exp $ */

 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *


@@ -334,6 +334,9 @@ while (generated != NULL)
   next->parent = addr;
   orflag(next, addr, af_ignore_error);
   next->start_router = rblock->redirect_router;
   next->parent = addr;
   orflag(next, addr, af_ignore_error);
   next->start_router = rblock->redirect_router;

+  if (addr->child_count == SHRT_MAX)
+    log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s router generated more than %d "
+      "child addresses for <%s>", rblock->name, SHRT_MAX, addr->address);

   addr->child_count++;
 
   next->next = *addr_new;
   addr->child_count++;
 
   next->next = *addr_new;