Fix SPA authenticator, checking client-supplied data before using it. Bug 2571

[exim.git] / src / src / verify.c

diff --git a/src/src/verify.c b/src/src/verify.c
index dda51a5a260e30bd2553d1df7b66019fbb464a12..fba1f6e9e0a96d80c447a9201bddc00ad563cc38 100644 (file)
--- a/src/src/verify.c
+++ b/src/src/verify.c
@@ -3,6 +3,7 @@
 *************************************************/
 
 /* Copyright (c) University of Cambridge 1995 - 2018 */
+/* Copyright (c) The Exim Maintainers 2020 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions concerned with verifying things. The original code for callout
@@ -2945,15 +2946,20 @@ if (*t == 0 || (*t == '/' && t != ss))
   return ERROR;
   }
 
-/* See if there is a semicolon in the pattern */
+/* See if there is a semicolon in the pattern, separating a searchtype
+prefix.  If there is one then check for comma-sep options. */
 
 if ((semicolon = Ustrchr(ss, ';')))
-  endname = (opts = Ustrchr(ss, ',')) ? opts : semicolon;
-if (opts)
-  {
-  opts++;
-  opts = string_copyn(opts, semicolon - opts);
-  }
+  if ((opts = Ustrchr(ss, ',')) && opts < semicolon)
+    {
+    endname = opts++;
+    opts = string_copyn(opts, semicolon - opts);
+    }
+  else
+    {
+    endname = semicolon;
+    opts = NULL;
+    }
 
 /* If we are doing an IP address only match, then all lookups must be IP
 address lookups, even if there is no "net-". */