From: Heiko Schlittermann (HS12-RIPE) Date: Wed, 25 Nov 2020 21:26:53 +0000 (+0100) Subject: SECURITY: Check overrun rcpt_count integer X-Git-Tag: exim-4.95-RC0~51^2~32 X-Git-Url: https://git.exim.org/exim.git/commitdiff_plain/87804cc1f325a3eb5a562b708deb0293402e1f8f?ds=sidebyside SECURITY: Check overrun rcpt_count integer Credits: Qualys 4/ In src/smtp_in.c: 4966 case RCPT_CMD: 4967 HAD(SCH_RCPT); 4968 rcpt_count++; .... 5123 if (rcpt_count > recipients_max && recipients_max > 0) In theory this recipients_max check can be bypassed, because the int rcpt_count can overflow (become negative). In practice this would either consume too much memory or generate too much network traffic, but maybe it should be fixed anyway. (cherry picked from commit 04139ca809fbe56d8fe9c55a77640ea9fa93b8f1) (cherry picked from commit db96ca55137d7684a9afdf9d118feed9116906b7) --- diff --git a/src/src/smtp_in.c b/src/src/smtp_in.c index 93d5cece3..b6d530f93 100644 --- a/src/src/smtp_in.c +++ b/src/src/smtp_in.c @@ -5036,6 +5036,10 @@ while (done <= 0) case RCPT_CMD: HAD(SCH_RCPT); + /* We got really to many recipients. A check against configured + limits is done later */ + if (rcpt_count < 0 || rcpt_count >= INT_MAX/2) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Too many recipients: %d", rcpt_count); rcpt_count++; was_rcpt = fl.rcpt_in_progress = TRUE; @@ -5192,7 +5196,7 @@ while (done <= 0) /* Check maximum allowed */ - if (rcpt_count > recipients_max && recipients_max > 0) + if (rcpt_count+1 < 0 || rcpt_count > recipients_max && recipients_max > 0) { if (recipients_max_reject) {