diff options
Diffstat (limited to 'gnu/packages/patches/exim-CVE-2017-16944.patch')
-rw-r--r-- | gnu/packages/patches/exim-CVE-2017-16944.patch | 87 |
1 files changed, 0 insertions, 87 deletions
diff --git a/gnu/packages/patches/exim-CVE-2017-16944.patch b/gnu/packages/patches/exim-CVE-2017-16944.patch deleted file mode 100644 index e4e8313c9c..0000000000 --- a/gnu/packages/patches/exim-CVE-2017-16944.patch +++ /dev/null @@ -1,87 +0,0 @@ -Fix CVE-2017-16944: - -https://bugs.exim.org/show_bug.cgi?id=2201 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16944 - -Patch copied from upstream source repository: - -https://git.exim.org/exim.git/commit/4804c62909a62a3ac12ec4777ebd48c541028965 - -From 4804c62909a62a3ac12ec4777ebd48c541028965 Mon Sep 17 00:00:00 2001 -From: "Heiko Schlittermann (HS12-RIPE)" <hs@schlittermann.de> -Date: Mon, 27 Nov 2017 22:42:33 +0100 -Subject: [PATCH] Chunking: do not treat the first lonely dot special. - CVE-2017-16944, Bug 2201 - -(cherry picked from commit 178ecb70987f024f0e775d87c2f8b2cf587dd542) - -Change log update - -(cherry picked from commit b488395f4d99d44a950073a64b35ec8729102782) ---- - doc/doc-txt/ChangeLog | 6 +++++- - src/src/receive.c | 2 +- - src/src/smtp_in.c | 7 +++++++ - 3 files changed, 13 insertions(+), 2 deletions(-) - -#diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog -#index a2d9339..541ebaf 100644 -#--- a/doc/doc-txt/ChangeLog -#+++ b/doc/doc-txt/ChangeLog -#@@ -61,7 +61,11 @@ JH/30 Fix a logging bug on aarch64: an unsafe routine was previously used for -# -# JH/34 Bug 2199: fix a use-after-free while reading smtp input for header lines. -# A crafted sequence of BDAT commands could result in in-use memory beeing -#- freed. -#+ freed. CVE-2017-16943. -#+ -#+HS/03 Bug 2201: Fix checking for leading-dot on a line during headers reading -#+ from SMTP input. Previously it was always done; now only done for DATA -#+ and not BDAT commands. CVE-2017-16944. -# -# -# Exim version 4.89 -diff --git a/src/src/receive.c b/src/src/receive.c -index 20672db..2812ea2 100644 ---- a/src/receive.c -+++ b/src/receive.c -@@ -1827,7 +1827,7 @@ for (;;) - prevent further reading), and break out of the loop, having freed the - empty header, and set next = NULL to indicate no data line. */ - -- if (ptr == 0 && ch == '.' && (smtp_input || dot_ends)) -+ if (ptr == 0 && ch == '.' && dot_ends) - { - ch = (receive_getc)(GETC_BUFFER_UNLIMITED); - if (ch == '\r') -diff --git a/src/src/smtp_in.c b/src/src/smtp_in.c -index 1b45f84..0207540 100644 ---- a/src/smtp_in.c -+++ b/src/smtp_in.c -@@ -4955,16 +4955,23 @@ while (done <= 0) - DEBUG(D_receive) debug_printf("chunking state %d, %d bytes\n", - (int)chunking_state, chunking_data_left); - -+ /* push the current receive_* function on the "stack", and -+ replace them by bdat_getc(), which in turn will use the lwr_receive_* -+ functions to do the dirty work. */ - lwr_receive_getc = receive_getc; - lwr_receive_ungetc = receive_ungetc; -+ - receive_getc = bdat_getc; - receive_ungetc = bdat_ungetc; - -+ dot_ends = FALSE; -+ - goto DATA_BDAT; - } - - case DATA_CMD: - HAD(SCH_DATA); -+ dot_ends = TRUE; - - DATA_BDAT: /* Common code for DATA and BDAT */ - if (!discarded && recipients_count <= 0) --- -1.9.1 - |