Fix ${listextract } from a tainted list

(cherry picked from commit 942f0be6c2cd3ec8c39ca234a449561d9d3c1075)

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 418b310f00a0d5164bb357a58a24a4e6e0f8454d..ddf755d27aefc77b8068a531627d5f2f88e0eeec 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -126,6 +126,9 @@ JH/31 The ESMTP option name advertised for the SUPPORT_EARLY_PIPE build option
 JH/32 Bug 2599: fix delay of delivery to a local address where there is also
       a remote which uses callout/hold.  Previously the local was queued.
 
+JH/33 Fix a taint trap in the ${listextract } expansion when the source data
+      was tainted.
+
 
 Exim version 4.94
 -----------------

diff --git a/src/src/expand.c b/src/src/expand.c
index bb9fd79efa6f6a2202b50eb52dcee2411e360861..05de94c491a709a9c46162c5d565a07979a4acb9 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -1298,15 +1298,16 @@ expand_getlistele(int field, const uschar * list)
 {
 const uschar * tlist = list;
 int sep = 0;
-uschar dummy;
+/* Tainted mem for the throwaway element copies */
+uschar * dummy = store_get(2, TRUE);
 
 if (field < 0)
   {
-  for (field++; string_nextinlist(&tlist, &sep, &dummy, 1); ) field++;
+  for (field++; string_nextinlist(&tlist, &sep, dummy, 1); ) field++;
   sep = 0;
   }
 if (field == 0) return NULL;
-while (--field > 0 && (string_nextinlist(&list, &sep, &dummy, 1))) ;
+while (--field > 0 && (string_nextinlist(&list, &sep, dummy, 1))) ;
 return string_nextinlist(&list, &sep, NULL, 0);
 }
 

diff --git a/test/scripts/0000-Basic/0002 b/test/scripts/0000-Basic/0002
index a8fc0bcb274770b166eb3496a73e8a64950b4240..0a24fe988cd74801640e41959c6abe4cfd61c496 100644 (file)
--- a/test/scripts/0000-Basic/0002
+++ b/test/scripts/0000-Basic/0002
@@ -1085,3 +1085,7 @@ exim -be
 ${if inlist{aa}{aa} {in list}{not in list}}
 ${if !inlist{aa}{aa} {not in list}{in list}}
 ****
+# listextract from tainted list
+exim -be -oMs my.target.host.name
+'\${listextract {2} {<. $sender_host_name}}'  =>   '${listextract {2} {<. $sender_host_name}}'
+****

diff --git a/test/stdout/0002 b/test/stdout/0002
index e12e5690a9e3ce8c9cced3c8e75f262696466eee..2cb01372e75d0cd282b51d1eaa12ddd5faeae05b 100644 (file)
--- a/test/stdout/0002
+++ b/test/stdout/0002
@@ -1012,3 +1012,5 @@ xyz
 > in list
 > in list
 > 
+> '${listextract {2} {<. my.target.host.name}}'  =>   'target'
+>