Taint: fix ACL "spam" condition, to permit tainted name arguments.

[users/heiko/exim.git] / src / src / spam.c

diff --git a/src/src/spam.c b/src/src/spam.c
index 9384bfa0dc120a65dc315e6b57b4c6178d7a7352..bd34dba8298be28a88f9501273fa9a9cfec86665 100644 (file)
--- a/src/src/spam.c
+++ b/src/src/spam.c
@@ -4,7 +4,7 @@
 
 /* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
  * License: GPL
- * Copyright (c) The Exim Maintainers 2016 - 2018
+ * Copyright (c) The Exim Maintainers 2016 - 2020
  */
 
 /* Code for calling spamassassin's spamd. Called from acl.c. */
@@ -137,7 +137,7 @@ spamd_get_server(spamd_address_container ** spamds, int num_servers)
 {
 unsigned int i;
 spamd_address_container * sd;
-long rnd, weights;
+long weights;
 unsigned pri;
 static BOOL srandomed = FALSE;
 
@@ -170,7 +170,7 @@ for (weights = 0, i = 0; i < num_servers; i++)
 if (weights == 0)      /* all servers failed */
   return -1;
 
-for (rnd = random() % weights, i = 0; i < num_servers; i++)
+for (long rnd = random() % weights, i = 0; i < num_servers; i++)
   {
   sd = spamds[i];
   if (!sd->is_failed && sd->priority == pri)
@@ -190,7 +190,6 @@ spam(const uschar **listptr)
 int sep = 0;
 const uschar *list = *listptr;
 uschar *user_name;
-uschar user_name_buffer[128];
 unsigned long mbox_size;
 FILE *mbox_file;
 client_conn_ctx spamd_cctx = {.sock = -1};
@@ -218,17 +217,14 @@ spamd_address_container * sd;
 result = 0;
 
 /* find the username from the option list */
-if ((user_name = string_nextinlist(&list, &sep,
-                                  user_name_buffer,
-                                  sizeof(user_name_buffer))) == NULL)
+if (!(user_name = string_nextinlist(&list, &sep, NULL, 0)))
   {
   /* no username given, this means no scanning should be done */
   return FAIL;
   }
 
 /* if username is "0" or "false", do not scan */
-if ( (Ustrcmp(user_name,"0") == 0) ||
-     (strcmpic(user_name,US"false") == 0) )
+if (Ustrcmp(user_name, "0") == 0 || strcmpic(user_name, US"false") == 0)
   return FAIL;
 
 /* if there is an additional option, check if it is "true" */
@@ -237,19 +233,15 @@ if (strcmpic(list,US"true") == 0)
   override = 1;
 
 /* expand spamd_address if needed */
-if (*spamd_address == '$')
+if (*spamd_address != '$')
+  spamd_address_work = spamd_address;
+else if (!(spamd_address_work = expand_string(spamd_address)))
   {
-  spamd_address_work = expand_string(spamd_address);
-  if (spamd_address_work == NULL)
-    {
-    log_write(0, LOG_MAIN|LOG_PANIC,
-      "%s spamd_address starts with $, but expansion failed: %s",
-      loglabel, expand_string_message);
-    return DEFER;
-    }
+  log_write(0, LOG_MAIN|LOG_PANIC,
+    "%s spamd_address starts with $, but expansion failed: %s",
+    loglabel, expand_string_message);
+  return DEFER;
   }
-else
-  spamd_address_work = spamd_address;
 
 DEBUG(D_acl) debug_printf_indent("spamd: addrlist '%s'\n", spamd_address_work);
 
@@ -293,7 +285,7 @@ start = time(NULL);
     uschar * s;
 
     DEBUG(D_acl) debug_printf_indent("spamd: addr entry '%s'\n", address);
-    sd = (spamd_address_container *)store_get(sizeof(spamd_address_container));
+    sd = store_get(sizeof(spamd_address_container), FALSE);
 
     for (sublist = address, args = 0, spamd_param_init(sd);
         (s = string_nextinlist(&sublist, &sublist_sep, NULL, 0));
@@ -344,7 +336,7 @@ start = time(NULL);
     for (;;)
       {
       /*XXX could potentially use TFO early-data here */
-      if (  (spamd_cctx.sock = ip_streamsocket(sd->hostspec, &errstr, 5)) >= 0
+      if (  (spamd_cctx.sock = ip_streamsocket(sd->hostspec, &errstr, 5, NULL)) >= 0
          || sd->retry <= 0
         )
        break;
@@ -380,7 +372,7 @@ if (sd->is_rspamd)
     "\r\nFrom: <", sender_address,
     ">\r\nRecipient-Number: ", string_sprintf("%d\r\n", recipients_count));
 
-  for (i = 0; i < recipients_count; i ++)
+  for (int i = 0; i < recipients_count; i++)
     req_str = string_append(req_str, 3,
       "Rcpt: <", recipients_list[i].address, ">\r\n");
   if ((s = expand_string(US"$sender_helo_name")) && *s)
@@ -503,7 +495,7 @@ offset = 0;
 while ((i = ip_recv(&spamd_cctx,
                   spamd_buffer + offset,
                   sizeof(spamd_buffer) - offset - 1,
-                  sd->timeout - time(NULL) + start)) > 0)
+                  sd->timeout + start)) > 0)
   offset += i;
 spamd_buffer[offset] = '\0';   /* guard byte */
 
@@ -565,7 +557,7 @@ else
     }
 
   Ustrcpy(spam_action_buffer,
-    spamd_score >= spamd_threshold ? "reject" : "no action");
+    spamd_score >= spamd_threshold ? US"reject" : US"no action");
   }
 
 /* Create report. Since this is a multiline string,