Fix crash from SRV lookup hitting a CNAME

(cherry picked from commit 14bc9cf085aff7bd5147881e5b7068769a29b026)
(cherry picked from commit 09720dd9506176294154dad7152f5f40554046a4)

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 26221318efdb93b31f6350c472346b2526b0ca8a..585ccffc8a8064d4c5585fd7b12d7cc81872a922 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -27,6 +27,10 @@ JH/07 GnuTLS: Our use of late (post-handshake) certificate verification, under
 JB/01 Bug 2375: fix expansions of 822 addresses having comments in local-part
       and/or domain.  Found and fixed by Jason Betts.
 
+JH/08 Add hardening against SRV & TLSA lookups the hit CNAMEs (a nonvalid
+      configuration).  If a CNAME target was not a wellformed name pattern, a
+      crash could result.
+
 
 Exim version 4.92
 -----------------

diff --git a/src/src/dns.c b/src/src/dns.c
index 0f0b435de288b9f7ca8bad0421086387f88daafc..b7978c52133519455a211bbc4ef2789175e9f7a0 100644 (file)
--- a/src/src/dns.c
+++ b/src/src/dns.c
@@ -716,7 +716,11 @@ lookup, which constructs the names itself, so they should be OK. Besides,
 bitstring labels don't conform to normal name syntax. (But the aren't used any
 more.)
 
-For SRV records, we omit the initial _smtp._tcp. components at the start. */
+For SRV records, we omit the initial _smtp._tcp. components at the start.
+The check has been seen to bite on the destination of a SRV lookup that
+initiall hit a CNAME, for which the next name had only two components.
+RFC2782 makes no mention of the possibiility of CNAMES, but the Wikipedia
+article on SRV says they are not a valid configuration. */
 
 #ifndef STAND_ALONE   /* Omit this for stand-alone tests */
 
@@ -732,8 +736,8 @@ if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT)
 
   if (type == T_SRV || type == T_TLSA)
     {
-    while (*checkname++ != '.');
-    while (*checkname++ != '.');
+    while (*checkname && *checkname++ != '.') ;
+    while (*checkname && *checkname++ != '.') ;
     }
 
   if (pcre_exec(regex_check_dns_names, NULL, CCS checkname, Ustrlen(checkname),