Fix ${listextract } from a tainted list

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 396ec336274d503419afafb08d1136c12f5982a9..c0f83125d2014d31bc323074baf791c51c6bd24d 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -159,6 +159,9 @@ JH/31 The ESMTP option name advertised for the SUPPORT_EARLY_PIPE build option
 JH/32 Bug 2599: fix delay of delivery to a local address where there is also
       a remote which uses callout/hold.  Previously the local was queued.
 
+JH/33 Fix a taint trap in the ${listextract } expansion when the source data
+      was tainted.
+
 
 Exim version 4.94
 -----------------

diff --git a/src/src/expand.c b/src/src/expand.c
index 21758d832c559aae546d484273e3174bf21db405..839821ef7e4ebbff6b44a4ad74d1463ec1cb0f13 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -1298,15 +1298,16 @@ expand_getlistele(int field, const uschar * list)
 {
 const uschar * tlist = list;
 int sep = 0;
-uschar dummy;
+/* Tainted mem for the throwaway element copies */
+uschar * dummy = store_get(2, TRUE);
 
 if (field < 0)
   {
-  for (field++; string_nextinlist(&tlist, &sep, &dummy, 1); ) field++;
+  for (field++; string_nextinlist(&tlist, &sep, dummy, 1); ) field++;
   sep = 0;
   }
 if (field == 0) return NULL;
-while (--field > 0 && (string_nextinlist(&list, &sep, &dummy, 1))) ;
+while (--field > 0 && (string_nextinlist(&list, &sep, dummy, 1))) ;
 return string_nextinlist(&list, &sep, NULL, 0);
 }
 

diff --git a/test/scripts/0000-Basic/0002 b/test/scripts/0000-Basic/0002
index 70b4e5f94ce85fcc89cde89fc3021379b2071d56..5101be453050e15ba9ee991303402b6f07ab1ff3 100644 (file)
--- a/test/scripts/0000-Basic/0002
+++ b/test/scripts/0000-Basic/0002
@@ -1107,3 +1107,7 @@ exim -be
 ${if inlist{aa}{aa} {in list}{not in list}}
 ${if !inlist{aa}{aa} {not in list}{in list}}
 ****
+# listextract from tainted list
+exim -be -oMs my.target.host.name
+'\${listextract {2} {<. $sender_host_name}}'  =>   '${listextract {2} {<. $sender_host_name}}'
+****

diff --git a/test/stdout/0002 b/test/stdout/0002
index 02ba087bab6946d829877f93b388211ac24a09ef..b55571cc6c08a41f64af2cc9e7e42a150bf74fe6 100644 (file)
--- a/test/stdout/0002
+++ b/test/stdout/0002
@@ -1034,3 +1034,5 @@ xyz
 > in list
 > in list
 > 
+> '${listextract {2} {<. my.target.host.name}}'  =>   'target'
+>