Taint: check on supplied buffer vs. list when extracting elements

[exim.git] / src / src / match.c

diff --git a/src/src/match.c b/src/src/match.c
index 0c0f3e8171ad5c297abfd1c0941b27e3071f7e76..6da1d2766e79ea15deb8a4cdfeb62c6e77098670 100644 (file)
--- a/src/src/match.c
+++ b/src/src/match.c
@@ -97,7 +97,7 @@ check_string(void *arg, const uschar *pattern, const uschar **valueptr, uschar *
 const check_string_block *cb = arg;
 int search_type, partial, affixlen, starflags;
 int expand_setup = cb->expand_setup;
-const uschar *affix;
+const uschar * affix, * opts;
 uschar *s;
 uschar *filename = NULL;
 uschar *keyquery, *result, *semicolon;
@@ -175,10 +175,9 @@ if (cb->at_is_special && pattern[0] == '@')
 
   if (Ustrcmp(pattern, "@[]") == 0)
     {
-    ip_address_item *ip;
     int slen = Ustrlen(s);
     if (s[0] != '[' && s[slen-1] != ']') return FAIL;
-    for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
+    for (ip_address_item * ip = host_find_interfaces(); ip; ip = ip->next)
       if (Ustrncmp(ip->address, s+1, slen - 2) == 0
             && ip->address[slen - 2] == 0)
         return OK;
@@ -264,7 +263,7 @@ the part of the string preceding the semicolon. */
 
 *semicolon = 0;
 search_type = search_findtype_partial(pattern, &partial, &affix, &affixlen,
-  &starflags);
+  &starflags, &opts);
 *semicolon = ';';
 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
   search_error_message);
@@ -277,14 +276,14 @@ if (!cb->use_partial) partial = -1;
 /* Set the parameters for the three different kinds of lookup. */
 
 keyquery = semicolon + 1;
-while (isspace(*keyquery)) keyquery++;
+Uskip_whitespace(&keyquery);
 
 if (mac_islookup(search_type, lookup_absfilequery))
   {
   filename = keyquery;
-  while (*keyquery != 0 && !isspace(*keyquery)) keyquery++;
+  while (*keyquery && !isspace(*keyquery)) keyquery++;
   filename = string_copyn(filename, keyquery - filename);
-  while (isspace(*keyquery)) keyquery++;
+  Uskip_whitespace(&keyquery);
   }
 
 else if (!mac_islookup(search_type, lookup_querystyle))
@@ -300,9 +299,9 @@ no search_close() because of the caching arrangements. */
 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
   log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
 result = search_find(handle, filename, keyquery, partial, affix, affixlen,
-  starflags, &expand_setup);
+  starflags, &expand_setup, opts);
 
-if (!result) return f.search_find_defer? DEFER : FAIL;
+if (!result) return f.search_find_defer ? DEFER : FAIL;
 if (valueptr) *valueptr = result;
 
 expand_nmax = expand_setup;
@@ -447,7 +446,6 @@ BOOL ignore_defer = FALSE;
 const uschar *list;
 uschar *sss;
 uschar *ot = NULL;
-uschar buffer[1024];
 
 /* Save time by not scanning for the option name when we don't need it. */
 
@@ -507,12 +505,12 @@ else
 
 /* For an unnamed list, use the expanded version in comments */
 
-HDEBUG(D_any) if (ot == NULL) ot = string_sprintf("%s in \"%s\"?", name, list);
+HDEBUG(D_any) if (!ot) ot = string_sprintf("%s in \"%s\"?", name, list);
 
 /* Now scan the list and process each item in turn, until one of them matches,
 or we hit an error. */
 
-while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))))
+while ((sss = string_nextinlist(&list, &sep, NULL, 0)))
   {
   uschar * ss = sss;
 
@@ -542,7 +540,7 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))))
     if (Ustrcmp(ss, "+caseful") == 0)
       {
       check_string_block *cb = (check_string_block *)arg;
-      Ustrcpy(cb->subject, cb->origsubject);
+      Ustrcpy(US cb->subject, cb->origsubject);
       cb->caseless = FALSE;
       continue;
       }
@@ -667,7 +665,7 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))))
             so we use the permanent store pool */
 
             store_pool = POOL_PERM;
-            p = store_get(sizeof(namedlist_cacheblock));
+            p = store_get(sizeof(namedlist_cacheblock), FALSE);
             p->key = string_copy(get_check_key(arg, type));
 
 
@@ -696,8 +694,8 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))))
         if (valueptr)
           {
           const uschar *key = get_check_key(arg, type);
-          namedlist_cacheblock *p;
-          for (p = nb->cache_data; p; p = p->next)
+
+          for (namedlist_cacheblock * p = nb->cache_data; p; p = p->next)
             if (Ustrcmp(key, p->key) == 0)
               {
               *valueptr = p->data;
@@ -1065,7 +1063,6 @@ looked up to obtain a list of local parts. If the subject's local part is just
 if (pattern[0] == '@' && pattern[1] == '@')
   {
   int watchdog = 50;
-  const uschar *key;
   uschar *list, *ss;
   uschar buffer[1024];
 
@@ -1074,7 +1071,7 @@ if (pattern[0] == '@' && pattern[1] == '@')
   /* Loop for handling chains. The last item in any list may be of the form
   ">name" in order to chain on to another list. */
 
-  for (key = sdomain + 1; key != NULL && watchdog-- > 0; )
+  for (const uschar * key = sdomain + 1; key && watchdog-- > 0; )
     {
     int sep = 0;
 
@@ -1277,9 +1274,9 @@ match_address_list(const uschar *address, BOOL caseless, BOOL expand,
   const uschar **listptr, unsigned int *cache_bits, int expand_setup, int sep,
   const uschar **valueptr)
 {
-uschar *p;
 check_address_block ab;
 unsigned int *local_cache_bits = cache_bits;
+int len;
 
 /* RFC 2505 recommends that for spam checking, local parts should be caselessly
 compared. Therefore, Exim now forces the entire address into lower case here,
@@ -1288,8 +1285,10 @@ patterns.) Otherwise just the domain is lower cases. A magic item "+caseful" in
 the list can be used to restore a caseful copy of the local part from the
 original address. */
 
-sprintf(CS big_buffer, "%.*s", big_buffer_size - 1, address);
-for (p = big_buffer + Ustrlen(big_buffer) - 1; p >= big_buffer; p--)
+if ((len = Ustrlen(address)) > 255) len = 255;
+ab.address = string_copyn(address, len);
+
+for (uschar * p = ab.address + len - 1; p >= ab.address; p--)
   {
   if (!caseless && *p == '@') break;
   *p = tolower(*p);
@@ -1310,7 +1309,7 @@ if (expand_setup == 0)
 /* Set up the data to be passed ultimately to check_address. */
 
 ab.origaddress = address;
-ab.address = big_buffer;
+/* ab.address is above */
 ab.expand_setup = expand_setup;
 ab.caseless = caseless;