Fix rare potential log buffer overflow.

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index c09c42f3c52ca246493fc8c027a8909e49036bbe..08907ffa7cdc0b47cf88a5bbb9aa81825e6aacbb 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -1,4 +1,4 @@
-$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.218 2005/09/12 10:08:53 ph10 Exp $
+$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.219 2005/09/12 10:49:30 ph10 Exp $
 
 Change log file for Exim from version 4.21
 -------------------------------------------
@@ -154,6 +154,11 @@ PH/36 When a locally submitted message by a trusted user did not contain a
 
 PH/37 Added control=suppress_local_fixups.
 
+PH/38 When log_selector = +received_sender was set, and the addition of the
+      sender made the log line's construction buffer exactly full, or one byte
+      less than full, an overflow happened when the terminating "\n" was
+      subsequently added.
+
 
 Exim version 4.52
 -----------------

diff --git a/src/src/log.c b/src/src/log.c
index 1427bd06122389c530a1c9bc17affb6ad5c64f6b..24418c5e66ebf179b261acb0d90684d7123f8cc4 100644 (file)
--- a/src/src/log.c
+++ b/src/src/log.c
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/log.c,v 1.6 2005/06/28 10:23:35 ph10 Exp $ */
+/* $Cambridge: exim/src/src/log.c,v 1.7 2005/09/12 10:49:30 ph10 Exp $ */
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
@@ -741,7 +741,7 @@ va_end(ap);
 this way because it kind of fits with LOG_RECIPIENTS. */
 
 if ((flags & LOG_SENDER) != 0 &&
-    ptr < log_buffer + LOG_BUFFER_SIZE - 8 - Ustrlen(raw_sender))
+    ptr < log_buffer + LOG_BUFFER_SIZE - 10 - Ustrlen(raw_sender))
   {
   sprintf(CS ptr, " from <%s>", raw_sender);
   while (*ptr) ptr++;