DKIM: fix buffer overflow in verify

Caused crash in free() by corrupting malloc metadata.

Reported-by: University of Cambridge
Broken-by: 80a47a2c96

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 8221fb564169877e0f76361454097b9987c22f4c..868e5910657f5faa10edd328cc21b1b82a4577e6 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -82,6 +82,9 @@ JH/15 Relax results from ACL control request to enable cutthrough, in
       ignoring.  This covers use with PRDR, frozen messages, queue-only and
       fake-reject.
 
+JH/16 Fix bug in DKIM verify: a buffer overflow could corrupt the malloc
+      metadata, resulting in a crash in free().
+
 
 Exim version 4.90
 -----------------

diff --git a/src/src/pdkim/pdkim.c b/src/src/pdkim/pdkim.c
index eec1a9c1621268d94fbac86295b9547c3bea99d2..df507381f7ad8e9e265a4059039739736d328967 100644 (file)
--- a/src/src/pdkim/pdkim.c
+++ b/src/src/pdkim/pdkim.c
@@ -710,7 +710,7 @@ if (b->canon_method == PDKIM_CANON_RELAXED)
   if (!relaxed_data)
     {
     BOOL seen_wsp = FALSE;
-    const uschar * p;
+    const uschar * p, * r;
     int q = 0;
 
     /* We want to be able to free this else we allocate
@@ -721,7 +721,7 @@ if (b->canon_method == PDKIM_CANON_RELAXED)
     relaxed_data = store_malloc(sizeof(blob) + orig_data->len+1);
     relaxed_data->data = US (relaxed_data+1);
 
-    for (p = orig_data->data; *p; p++)
+    for (p = orig_data->data, r = p + orig_data->len; p < r; p++)
       {
       char c = *p;
       if (c == '\r')
@@ -848,6 +848,7 @@ ctx->linebuf_offset = 0;
 
 /* -------------------------------------------------------------------------- */
 /* Call from pdkim_feed below for processing complete body lines */
+/* NOTE: the line is not NUL-terminated; but we have a count */
 
 static void
 pdkim_bodyline_complete(pdkim_ctx * ctx)