From: Jeremy Harris <jgh146exb@wizmail.org>
Date: Mon, 19 Aug 2019 11:03:46 +0000 (+0100)
Subject: taint nonrcpt names read from spool
X-Git-Tag: exim-4.93-RC0~97
X-Git-Url: https://git.exim.org/exim.git/commitdiff_plain/d81d33cfe0fbf91fc8f87f8ed9cb92e60f23212c

taint nonrcpt names read from spool
---

diff --git a/src/src/local_scan.h b/src/src/local_scan.h
index b250a163b..235812ada 100644
--- a/src/src/local_scan.h
+++ b/src/src/local_scan.h
@@ -120,7 +120,7 @@ typedef struct {
   void         *value;
 } optionlist;
 
-/*Structure for holding information about an envelope address. The errors_to
+/* Structure for holding information about an envelope address. The errors_to
 field is always NULL except for one_time aliases that had errors_to on the
 routers that generated them. */
 
diff --git a/src/src/spool_in.c b/src/src/spool_in.c
index c70835c29..25e431b2b 100644
--- a/src/src/spool_in.c
+++ b/src/src/spool_in.c
@@ -185,7 +185,7 @@ BOOL right = buffer[1] == 'Y';
 
 if (n < 5) return FALSE;    /* malformed line */
 buffer[n-1] = 0;            /* Remove \n */
-node = store_get(sizeof(tree_node) + n - 3, is_tainted(buffer));
+node = store_get(sizeof(tree_node) + n - 3, TRUE);	/* rcpt names tainted */
 *connect = node;
 Ustrcpy(node->name, buffer + 3);
 node->data.ptr = NULL;
@@ -708,7 +708,7 @@ host_build_sender_fullhost();
 #ifndef COMPILE_UTILITY
 DEBUG(D_deliver)
   debug_printf("sender_local=%d ident=%s\n", f.sender_local,
-    (sender_ident == NULL)? US"unset" : sender_ident);
+    sender_ident ? sender_ident : US"unset");
 #endif  /* COMPILE_UTILITY */
 
 /* We now have the tree of addresses NOT to deliver to, or a line
@@ -920,8 +920,8 @@ while ((n = fgetc(fp)) != EOF)
 
     if (h->type == htype_received) received_count++;
 
-    if (header_list == NULL) header_list = h;
-      else header_last->next = h;
+    if (header_list) header_last->next = h;
+    else header_list = h;
     header_last = h;
 
     for (i = 0; i < n; i++)
@@ -973,7 +973,7 @@ if (errno != 0)
 
   fclose(fp);
   errno = n;
-  return inheader? spool_read_hdrerror : spool_read_enverror;
+  return inheader ? spool_read_hdrerror : spool_read_enverror;
   }
 
 SPOOL_FORMAT_ERROR: