Taint: fix pam expansion condition. Bug 2587

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index a4526ca5cc1b55768100285da6f1476b094620b1..93bd62cc47e3433bddc20c0019b2f992c7239450 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -10,6 +10,11 @@ JH/01 Bug 1329: Fix format of Maildir-format filenames to match other mail-
       related applications.  Previously an "H" was used where available info
       says that "M" should be, so change to match.
 
+JH/02 Bug 2587: Fix pam expansion condition.  Tainted values are commonly used
+      as arguments, so an implementation trying to copy these into local
+      buffer was taking a taint-enformance trap.  Fix by using dynamically
+      created buffers.
+
 
 Exim version 4.94
 -----------------

diff --git a/src/src/auths/call_pam.c b/src/src/auths/call_pam.c
index 2959cbbf382d0c84927933f8c35b885751f942bc..80bb23ec396759226b445759b4b639b4b2b8211d 100644 (file)
--- a/src/src/auths/call_pam.c
+++ b/src/src/auths/call_pam.c
@@ -83,8 +83,7 @@ for (int i = 0; i < num_msg; i++)
     {
     case PAM_PROMPT_ECHO_ON:
     case PAM_PROMPT_ECHO_OFF:
-      arg = string_nextinlist(&pam_args, &sep, big_buffer, big_buffer_size);
-      if (!arg)
+      if (!(arg = string_nextinlist(&pam_args, &sep, NULL, 0)))
        {
        arg = US"";
        pam_arg_ended = TRUE;
@@ -155,7 +154,7 @@ pam_arg_ended = FALSE;
 fail. PAM doesn't support authentication with an empty user (it prompts for it,
 causing a potential mis-interpretation). */
 
-user = string_nextinlist(&pam_args, &sep, big_buffer, big_buffer_size);
+user = string_nextinlist(&pam_args, &sep, NULL, 0);
 if (user == NULL || user[0] == 0) return FAIL;
 
 /* Start off PAM interaction */