Taint: treat $message_body & $message_body_end as tainted

[users/heiko/exim.git] / src / src / expand.c

diff --git a/src/src/expand.c b/src/src/expand.c
index b01512425e48eeb9d79a2b9a72e0b9c108a1acde..f7e9e5c2554487ad537f5416247ea5f2711b2644 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -1984,11 +1984,12 @@ switch (vp->type)
     ss = (uschar **)(val);
     if (!*ss && deliver_datafile >= 0)  /* Read body when needed */
       {
-      uschar *body;
+      uschar * body;
       off_t start_offset = SPOOL_DATA_START_OFFSET;
       int len = message_body_visible;
+
       if (len > message_size) len = message_size;
-      *ss = body = store_malloc(len+1);
+      *ss = body = store_get(len+1, TRUE);
       body[0] = 0;
       if (vp->type == vtype_msgbody_end)
        {
@@ -2003,8 +2004,7 @@ switch (vp->type)
       if (lseek(deliver_datafile, start_offset, SEEK_SET) < 0)
        log_write(0, LOG_MAIN|LOG_PANIC_DIE, "deliver_datafile lseek: %s",
          strerror(errno));
-      len = read(deliver_datafile, body, len);
-      if (len > 0)
+      if ((len = read(deliver_datafile, body, len)) > 0)
        {
        body[len] = 0;
        if (message_body_newlines)   /* Separate loops for efficiency */
@@ -4390,7 +4390,7 @@ if (is_tainted(string))
   goto EXPAND_FAILED;
   }
 
-while (*s != 0)
+while (*s)
   {
   uschar *value;
   uschar name[256];
@@ -4776,7 +4776,7 @@ while (*s != 0)
       int save_expand_nmax =
         save_expand_strings(save_expand_nstring, save_expand_nlength);
 
-      if ((expand_forbid & RDO_LOOKUP) != 0)
+      if (expand_forbid & RDO_LOOKUP)
         {
         expand_string_message = US"lookup expansions are not permitted";
         goto EXPAND_FAILED;
@@ -4875,21 +4875,7 @@ while (*s != 0)
       file types, the query (i.e. "key") starts with a file name. */
 
       if (!key)
-        {
-       Uskip_whitespace(&filename);
-        key = filename;
-
-        if (mac_islookup(stype, lookup_querystyle))
-          filename = NULL;
-        else
-          if (*filename == '/')
-           {
-           while (*key && !isspace(*key)) key++;
-           if (*key) *key++ = '\0';
-           }
-         else
-           filename = NULL;
-        }
+       key = search_args(stype, name, filename, &filename, opts);
 
       /* If skipping, don't do the next bit - just lookup_value == NULL, as if
       the entry was not found. Note that there is no search_close() function.