From: Jeremy Harris <jgh146exb@wizmail.org>
Date: Fri, 30 Sep 2016 13:59:04 +0000 (+0100)
Subject: Fix mime ACL filename decode
X-Git-Tag: exim-4_88_RC2~8
X-Git-Url: https://git.exim.org/exim.git/commitdiff_plain/f1d38a56d8aa122a13f84db36bd1db1ceb489454

Fix mime ACL filename decode

A latent bug (uninitialised memory referred to by $mime_decoded_filename)
uncovered by 40c90bca9f7e
---

diff --git a/src/src/mime.c b/src/src/mime.c
index c924f2bc3..17643eda3 100644
--- a/src/src/mime.c
+++ b/src/src/mime.c
@@ -188,19 +188,17 @@ return size;
 }
 
 
+/*
+ * Return open filehandle for combo of path and file.
+ * Side-effect: set mime_decoded_filename, to copy in allocated mem
+ */
 static FILE *
 mime_get_decode_file(uschar *pname, uschar *fname)
 {
-FILE *f = NULL;
-uschar *filename = NULL;
-
 if (pname && fname)
-  {
-  filename = string_sprintf("%s/%s", pname, fname);
-  f = modefopen(filename,"wb+",SPOOL_MODE);
-  }
+  mime_decoded_filename = string_sprintf("%s/%s", pname, fname);
 else if (!pname)
-  f = modefopen(fname,"wb+",SPOOL_MODE);
+  mime_decoded_filename = string_copy(fname);
 else if (!fname)
   {
   int file_nr = 0;
@@ -210,21 +208,15 @@ else if (!fname)
   do
     {
     struct stat mystat;
-    filename = string_sprintf("%s/%s-%05u", pname, message_id, file_nr++);
+    mime_decoded_filename = string_sprintf("%s/%s-%05u", pname, message_id, file_nr++);
     /* security break */
     if (file_nr >= 1024)
       break;
-    result = stat(CS filename, &mystat);
+    result = stat(CS mime_decoded_filename, &mystat);
     } while(result != -1);
-
-  f = modefopen(filename, "wb+", SPOOL_MODE);
   }
 
-/* set expansion variable */
-/*XXX ? not set if !pname ? */
-mime_decoded_filename = filename;
-
-return f;
+return modefopen(mime_decoded_filename, "wb+", SPOOL_MODE);
 }
 
 
@@ -809,7 +801,7 @@ while(1)
     if (!mime_decoded_filename)		/* decoding failed */
       {
       log_write(0, LOG_MAIN,
-	   "mime_regex acl condition warning - could not decode RFC822 MIME part to file.");
+	   "MIME acl condition warning - could not decode RFC822 MIME part to file.");
       rc = DEFER;
       goto out;
       }