From: Phil Pennock <phil+git@pennock-tech.com>
Date: Fri, 30 Oct 2020 02:40:59 +0000 (-0400)
Subject: SECURITY: fix SMTP verb option parsing
X-Git-Tag: exim-4.95-RC0~51^2~40
X-Git-Url: https://git.exim.org/exim.git/commitdiff_plain/518f0a0dd6df6f0d0ea51bfa126982d134e7a7ff

SECURITY: fix SMTP verb option parsing

A boundary case in looking for an opening quote before the closing quote could
walk off the front of the buffer.

(cherry picked from commit 515d8d43a18481d23d7cf410b8dc71b4e254ebb8)
(cherry picked from commit 467948de0c407bd2bbc2e84abbbf09f35b035538)
---

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 3d0e638d2..9837d6c0f 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -285,6 +285,9 @@ PP/09 Fix security issue with too many recipients on a message (to remove a
       or if local additions add to the recipient list).
       Fixes CVE-2020-RCPTL reported by Qualys.
 
+PP/10 Fix security issue in SMTP verb option parsing
+      Fixes CVE-2020-EXOPT reported by Qualys.
+
 
 Exim version 4.94
 -----------------
diff --git a/src/src/smtp_in.c b/src/src/smtp_in.c
index d60e7d5c5..4f16fd4b8 100644
--- a/src/src/smtp_in.c
+++ b/src/src/smtp_in.c
@@ -1969,12 +1969,13 @@ extract_option(uschar **name, uschar **value)
 uschar *n;
 uschar *v = smtp_cmd_data + Ustrlen(smtp_cmd_data) - 1;
 while (isspace(*v)) v--;
-v[1] = 0;
+v[1] = '\0';
 while (v > smtp_cmd_data && *v != '=' && !isspace(*v))
   {
   /* Take care to not stop at a space embedded in a quoted local-part */
 
-  if (*v == '"') do v--; while (*v != '"' && v > smtp_cmd_data+1);
+  if ((*v == '"') && (v > smtp_cmd_data + 1))
+    do v--; while (*v != '"' && v > smtp_cmd_data+1);
   v--;
   }