taint SNI values supplied by client
authorJeremy Harris <jgh146exb@wizmail.org>
Mon, 19 Aug 2019 14:50:57 +0000 (15:50 +0100)
committerJeremy Harris <jgh146exb@wizmail.org>
Mon, 19 Aug 2019 14:57:13 +0000 (15:57 +0100)
src/src/tls-gnu.c
src/src/tls-openssl.c

index de44313..973b135 100644 (file)
@@ -1957,7 +1957,7 @@ if (sni_type != GNUTLS_NAME_DNS)
 /* We now have a UTF-8 string in sni_name */
 old_pool = store_pool;
 store_pool = POOL_PERM;
-state->received_sni = string_copyn(US sni_name, data_len);
+state->received_sni = string_copy_taint(US sni_name, TRUE);
 store_pool = old_pool;
 
 /* We set this one now so that variable expansions below will work */
index d686720..b9798f6 100644 (file)
@@ -1570,7 +1570,7 @@ DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
 
 /* Make the extension value available for expansion */
 store_pool = POOL_PERM;
-tls_in.sni = string_copy(US servername);
+tls_in.sni = string_copy_taint(US servername, TRUE);
 store_pool = old_pool;
 
 if (!reexpand_tls_files_for_sni)