From: Jeremy Harris <jgh146exb@wizmail.org>
Date: Mon, 19 Aug 2019 14:50:57 +0000 (+0100)
Subject: taint SNI values supplied by client
X-Git-Tag: exim-4.93-RC0~94
X-Git-Url: https://git.exim.org/exim.git/commitdiff_plain/89a80675800115043189ea51437b062d88fa51b7?hp=314db5bae8fbce6bf72f37096dc3a042696e8448

taint SNI values supplied by client
---

diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index de44313e8..973b135f6 100644
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -1957,7 +1957,7 @@ if (sni_type != GNUTLS_NAME_DNS)
 /* We now have a UTF-8 string in sni_name */
 old_pool = store_pool;
 store_pool = POOL_PERM;
-state->received_sni = string_copyn(US sni_name, data_len);
+state->received_sni = string_copy_taint(US sni_name, TRUE);
 store_pool = old_pool;
 
 /* We set this one now so that variable expansions below will work */
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index d6867200c..b9798f68b 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -1570,7 +1570,7 @@ DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
 
 /* Make the extension value available for expansion */
 store_pool = POOL_PERM;
-tls_in.sni = string_copy(US servername);
+tls_in.sni = string_copy_taint(US servername, TRUE);
 store_pool = old_pool;
 
 if (!reexpand_tls_files_for_sni)