More checks on header line length during reception

[exim.git] / src / src / receive.c

diff --git a/src/src/receive.c b/src/src/receive.c
index 93b350a65218574c828af06ebd12110b4c9e5729..a0467e8c8990e0480e3e9c865e085f93b940aea7 100644 (file)
--- a/src/src/receive.c
+++ b/src/src/receive.c
@@ -1827,8 +1827,11 @@ for (;;)
   if (ptr >= header_size - 4)
     {
     int oldsize = header_size;
-    /* header_size += 256; */
+
+    if (header_size >= INT_MAX/2)
+      goto OVERSIZE;
     header_size *= 2;
+
     if (!store_extend(next->text, oldsize, header_size))
       next->text = store_newblock(next->text, header_size, ptr);
     }
@@ -1934,6 +1937,7 @@ for (;;)
 
   if (message_size >= header_maxsize)
     {
+OVERSIZE:
     next->text[ptr] = 0;
     next->slen = ptr;
     next->type = htype_other;
@@ -2005,7 +2009,8 @@ for (;;)
     if (nextch == ' ' || nextch == '\t')
       {
       next->text[ptr++] = nextch;
-      message_size++;
+      if (++message_size >= header_maxsize)
+       goto OVERSIZE;
       continue;                      /* Iterate the loop */
       }
     else if (nextch != EOF) (receive_ungetc)(nextch);   /* For next time */
@@ -3244,16 +3249,16 @@ if (extract_recip && (bad_addresses || recipients_count == 0))
     if (recipients_count == 0) debug_printf("*** No recipients\n");
     if (bad_addresses)
       {
-      error_block *eblock = bad_addresses;
+      error_block * eblock;
       debug_printf("*** Bad address(es)\n");
-      while (eblock != NULL)
-        {
+      for (eblock = bad_addresses; eblock; eblock = eblock->next)
         debug_printf("  %s: %s\n", eblock->text1, eblock->text2);
-        eblock = eblock->next;
-        }
       }
     }
 
+  log_write(0, LOG_MAIN|LOG_PANIC, "%s %s found in headers",
+    message_id, bad_addresses ? "bad addresses" : "no recipients");
+
   fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
 
   /* If configured to send errors to the sender, but this fails, force
@@ -3265,11 +3270,12 @@ if (extract_recip && (bad_addresses || recipients_count == 0))
   if (error_handling == ERRORS_SENDER)
     {
     if (!moan_to_sender(
-          (bad_addresses == NULL)?
-            (extracted_ignored? ERRMESS_IGADDRESS : ERRMESS_NOADDRESS) :
-          (recipients_list == NULL)? ERRMESS_BADNOADDRESS : ERRMESS_BADADDRESS,
-          bad_addresses, header_list, spool_data_file, FALSE))
-      error_rc = (bad_addresses == NULL)? EXIT_NORECIPIENTS : EXIT_FAILURE;
+          bad_addresses
+         ? recipients_list ? ERRMESS_BADADDRESS : ERRMESS_BADNOADDRESS
+         : extracted_ignored ? ERRMESS_IGADDRESS : ERRMESS_NOADDRESS,
+          bad_addresses, header_list, spool_data_file, FALSE
+       )              )
+      error_rc = bad_addresses ? EXIT_FAILURE : EXIT_NORECIPIENTS;
     }
   else
     {