Taint: fix ACL "spam" condition, to permit tainted name arguments.

Cherry-picked from: 62b2ccce05

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 8a13bda87ab348f5d97e939ae39a64008c14224a..6a867c716b37999ade04fe6b9276bed8321852c6 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -55,6 +55,10 @@ JH/13 Fix dsearch "subdir" filter to ignore ".".  Previously only ".." was
 JH/14 Bug 2606: Fix a segfault in sqlite lookups.  When no, or a bad, filename
       was given for the sqlite_dbfile a trap resulted.
 
+JH/15 Fix "spam" ACL condition.  Previously, tainted values for the "name"
+      argument resulted in a trap.  There is no reason to disallow such; this
+      was a coding error.
+
 
 Exim version 4.94
 -----------------

diff --git a/src/src/spam.c b/src/src/spam.c
index 5eff1ad5cb43b3c47241082786646767f55b4d8d..63ced4f658d0dac0f3f92cff7316bdd5feb115c7 100644 (file)
--- a/src/src/spam.c
+++ b/src/src/spam.c
@@ -190,7 +190,6 @@ spam(const uschar **listptr)
 int sep = 0;
 const uschar *list = *listptr;
 uschar *user_name;
-uschar user_name_buffer[128];
 unsigned long mbox_size;
 FILE *mbox_file;
 client_conn_ctx spamd_cctx = {.sock = -1};
@@ -218,9 +217,7 @@ spamd_address_container * sd;
 result = 0;
 
 /* find the username from the option list */
-if ((user_name = string_nextinlist(&list, &sep,
-                                  user_name_buffer,
-                                  sizeof(user_name_buffer))) == NULL)
+if (!(user_name = string_nextinlist(&list, &sep, NULL, 0)))
   {
   /* no username given, this means no scanning should be done */
   return FAIL;