From: Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Date: Mon, 12 Apr 2021 21:05:44 +0000 (+0200)
Subject: CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
X-Git-Tag: exim-4.94.1~7
X-Git-Url: https://git.exim.org/exim.git/commitdiff_plain/8b1e9bc2cac17ee24d595c97dcf97d9b016f8a46

CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()

Based on Phil Pennock's commit 76a1ce77.
Modified by Qualys.

(cherry picked from commit f218fef171cbe9e61d10f15399aab8fa6956535b)
---

diff --git a/src/src/parse.c b/src/src/parse.c
index 32b42cd29..086b010c3 100644
--- a/src/src/parse.c
+++ b/src/src/parse.c
@@ -979,12 +979,12 @@ if (i < len)
 
 /* No non-printers; use the RFC 822 quoting rules */
 
-if (!len)
+if (len <= 0 || len >= INT_MAX/4)
   {
-  return string_copy_taint(US"", is_tainted(phrase));
+  return string_copy_taint(CUS"", is_tainted(phrase));
   }
 
-buffer = store_get(len*4, is_tainted(phrase));
+buffer = store_get((len+1)*4, is_tainted(phrase));
 
 s = phrase;
 end = s + len;