Do not permit change-of-separator for pam/radius expansion conditions

diff --git a/src/src/auths/call_pwcheck.c b/src/src/auths/call_pwcheck.c
index 88f708f627631e9e9afc79b28a7faa567da79894..5903d696e7d3c88aaccb20914f6165d7942c07b8 100644 (file)
--- a/src/src/auths/call_pwcheck.c
+++ b/src/src/auths/call_pwcheck.c
@@ -37,10 +37,9 @@ Returns:   OK if authentication succeeded
 int
 auth_call_pwcheck(uschar *s, uschar **errptr)
 {
 int
 auth_call_pwcheck(uschar *s, uschar **errptr)
 {

-uschar *reply = NULL;
-uschar *pw = Ustrrchr(s, ':');
+uschar * reply = NULL, * pw = Ustrrchr(s, ':');

 
 

-if (pw == NULL)
+if (!pw)

   {
   *errptr = US"pwcheck: malformed input - missing colon";
   return ERROR;
   {
   *errptr = US"pwcheck: malformed input - missing colon";
   return ERROR;

diff --git a/src/src/auths/cyrus_sasl.c b/src/src/auths/cyrus_sasl.c
index ed0995637bde81b8b8d5f240d86f8efadcc9444a..3b16ebcc9a5c9be31f3a3bc0dbf4a59738df1cc9 100644 (file)
--- a/src/src/auths/cyrus_sasl.c
+++ b/src/src/auths/cyrus_sasl.c
@@ -111,7 +111,7 @@ auth_cyrus_sasl_init(driver_instance * a)
 auth_instance * ablock = (auth_instance *)a;
 auth_cyrus_sasl_options_block * ob = a->options_block;
 const uschar *list, *listptr, *buffer;
 auth_instance * ablock = (auth_instance *)a;
 auth_cyrus_sasl_options_block * ob = a->options_block;
 const uschar *list, *listptr, *buffer;

-int rc, i;
+int rc, sep;

 unsigned int len;
 rmark rs_point;
 uschar *expanded_hostname;
 unsigned int len;
 rmark rs_point;
 uschar *expanded_hostname;


@@ -153,11 +153,11 @@ if ((rc = sasl_server_new(CS ob->server_service, CS expanded_hostname,
   log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s authenticator:  "
       "couldn't initialise Cyrus SASL server connection.", a->name);
 
   log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s authenticator:  "
       "couldn't initialise Cyrus SASL server connection.", a->name);
 

-if ((rc = sasl_listmech(conn, NULL, "", ":", "", CCSS &list, &len, &i)) != SASL_OK)
+if ((rc = sasl_listmech(conn, NULL, "", ":", "", CCSS &list, &len, NULL)) != SASL_OK)

   log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s authenticator:  "
       "couldn't get Cyrus SASL mechanism list.", a->name);
 
   log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s authenticator:  "
       "couldn't get Cyrus SASL mechanism list.", a->name);
 

-i = ':';
+sep = ':';

 listptr = list;
 
 HDEBUG(D_auth)
 listptr = list;
 
 HDEBUG(D_auth)


@@ -176,7 +176,7 @@ rs_point = store_mark();
 /* loop until either we get to the end of the list, or we match the
 public name of this authenticator */
 
 /* loop until either we get to the end of the list, or we match the
 public name of this authenticator */
 

-while (  (buffer = string_nextinlist(&listptr, &i, NULL, 0))
+while (  (buffer = string_nextinlist(&listptr, &sep, NULL, 0))

       && strcmpic(buffer,ob->server_mech) );
 
 if (!buffer)
       && strcmpic(buffer,ob->server_mech) );
 
 if (!buffer)

diff --git a/src/src/miscmods/pam.c b/src/src/miscmods/pam.c
index 1c94cc29f7842c48e0e01a1adb2a08f8b0aad16a..1d391593ade797e84d338c34775eb735a83927e4 100644 (file)
--- a/src/src/miscmods/pam.c
+++ b/src/src/miscmods/pam.c
@@ -120,7 +120,7 @@ return PAM_SUCCESS;
 more data strings.
 
 Arguments:
 more data strings.
 
 Arguments:

-  s        a colon-separated list of strings
+  s        a (not-changeable-colon)-separated list of strings

   errptr   where to point an error message
 
 Returns:   OK if authentication succeeded
   errptr   where to point an error message
 
 Returns:   OK if authentication succeeded


@@ -129,12 +129,12 @@ Returns:   OK if authentication succeeded
 */
 
 static int
 */
 
 static int

-auth_call_pam(const uschar *s, uschar **errptr)
+auth_call_pam(const uschar * s, uschar ** errptr)

 {
 pam_handle_t *pamh = NULL;
 struct pam_conv pamc;
 int pam_error;
 {
 pam_handle_t *pamh = NULL;
 struct pam_conv pamc;
 int pam_error;

-int sep = 0;
+int sep = ':'; /* Do not permit change-of-separator */

 uschar *user;
 
 /* Set up the input data structure: the address of the conversation function,
 uschar *user;
 
 /* Set up the input data structure: the address of the conversation function,

diff --git a/src/src/miscmods/radius.c b/src/src/miscmods/radius.c
index b52c06ec135ef8077f3b0b8935eef96f48a3d95e..8e784438b5493c62e5ae4553c220d7155c4462d4 100644 (file)
--- a/src/src/miscmods/radius.c
+++ b/src/src/miscmods/radius.c
@@ -73,7 +73,7 @@ auth_call_radius(const uschar *s, uschar **errptr)
 uschar *user;
 const uschar *radius_args = s;
 int result;
 uschar *user;
 const uschar *radius_args = s;
 int result;

-int sep = 0;
+int sep = ':';

 
 #ifdef RADIUS_LIB_RADLIB
   struct rad_handle *h;
 
 #ifdef RADIUS_LIB_RADLIB
   struct rad_handle *h;