Rewrites: fix delivery crash from constant errors_to. Bug 3081

Broken-by: 753739fdef6d

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 20dcd13488f69b0ad139d57b4274ed53ee7c954f..3dc0e551256545889795c6da7bfd7a23748b0fe6 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -120,6 +120,11 @@ JH/22 The ESMTP_LIMITS facility (RFC 9422) is promoted from experimental status
 
 JH/23 Bug 3066: Avoid leaking lookup database credentials to log.
 
+JH/24 Bug 3081: Fix a delivery process crash.  When the router "errors_to"
+      option specified a fixed address, later rewriting on that address would
+      trip on the configuration data being readonly.  Instead of modifying
+      in-place, copy data.  Found and fixed by Peter Benie.
+
 
 Exim version 4.97
 -----------------
@@ -695,7 +700,7 @@ JH/44 Bug 2701: Fix list-expansion of dns_ipv4_lookup.  Previously, it did
       mx_fail_domains.
 
 JH/45 Use a (new) separate store pool-pair for DKIM verify working data.
-      Previously the permanent pool was used, so the sore could not be freed.
+      Previously the permanent pool was used, so the store could not be freed.
       This meant a connection with many messages would use continually-growing
       memory.
 

diff --git a/src/src/rewrite.c b/src/src/rewrite.c
index 70bd79e262aa38589f5032957ef8703fb10a3501..9ee5a6794a777383461798bafdae7806f1c60a87 100644 (file)
--- a/src/src/rewrite.c
+++ b/src/src/rewrite.c
@@ -104,7 +104,7 @@ rewrite_one(const uschar *s, int flag, BOOL *whole, BOOL add_header, uschar *nam
 {
 const uschar *yield = s;
 const uschar *subject = s;
-uschar *domain = NULL;
+const uschar *domain = NULL;
 BOOL done = FALSE;
 int rule_number = 1;
 int yield_start = 0, yield_end = 0;
@@ -158,7 +158,7 @@ for (rewrite_rule * rule = rewrite_rules;
 
   else
     {
-    if (!domain) domain = Ustrrchr(subject, '@') + 1;
+    if (!domain) domain = CUstrrchr(subject, '@') + 1;
 
     /* Use the general function for matching an address against a list (here
     just one item, so use the "impossible value" separator UCHAR_MAX+1). */
@@ -182,16 +182,14 @@ for (rewrite_rule * rule = rewrite_rules;
     save_domain = deliver_domain;
 
     /* We have subject pointing to "localpart@domain" and domain pointing to
-    the domain. Temporarily terminate the local part so that it can be
-    set up as an expansion variable */
+    the domain. Split into local part and domain so that it can be set up as 
+    an expansion variable */
 
-    domain[-1] = 0;
-    deliver_localpart = US subject;
+    deliver_localpart = US string_copyn(subject, domain-subject-1);
     deliver_domain = domain;
 
     new = expand_string(rule->replacement);
 
-    domain[-1] = '@';
     deliver_localpart = save_localpart;
     deliver_domain = save_domain;
     }