SECURITY: fix Qualys CVE-2020-PFPZA

(cherry picked from commit 29d7a8c25f182c91d5d30f124f9e296dce5c018e)
(cherry picked from commit 0a6a7a3fd8464bae9ce0cf889e8eeb0bf0bab756)

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 07fba9c23f8130343f48f8ea0e31e03b1b5cb031..95b95e7940f0f78fbc3326fe60ee94cd65082bf5 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -273,6 +273,9 @@ PP/05 Fix security issue CVE-2020-PFPSN and guard against cmdline invoker
       providing a particularly obnoxious sender full name.
       Reported by Qualys.
 
       providing a particularly obnoxious sender full name.
       Reported by Qualys.
 

+pp/06 Fix CVE-2020-28016 (PFPZA): Heap out-of-bounds write in parse_fix_phrase()
+
+

 
 Exim version 4.94
 -----------------
 
 Exim version 4.94
 -----------------

diff --git a/src/src/parse.c b/src/src/parse.c
index 7dfb9a7eb5f0e69774bcad94c7b4df4913251da0..8d689e88adc349b59cafd110813d64779fc562fa 100644 (file)
--- a/src/src/parse.c
+++ b/src/src/parse.c
@@ -984,6 +984,11 @@ if (i < len)
 
 /* No non-printers; use the RFC 822 quoting rules */
 
 
 /* No non-printers; use the RFC 822 quoting rules */
 

+if (!len)
+  {
+  return string_copy_taint_function("", is_tainted(phrase));
+  }
+

 buffer = store_get(len*4, is_tainted(phrase));
 
 s = phrase;
 buffer = store_get(len*4, is_tainted(phrase));
 
 s = phrase;