Fix crash in mime acl when a parameter is unterminated

Verified-by: Wolfgang Breyha <wbreyha@gmx.net>

diff --git a/src/src/mime.c b/src/src/mime.c
index a61e9f22f15844623fd5d81ab199feab987c4ed2..e5fe476d0f8892aa04147259eec99be259bb42e2 100644 (file)
--- a/src/src/mime.c
+++ b/src/src/mime.c
@@ -599,46 +599,35 @@ NEXT_PARAM_SEARCH:
            /* found an interesting parameter? */
            if (strncmpic(mp->name, p, mp->namelen) == 0)
              {
-             uschar * q = p + mp->namelen;
-             int plen = 0;
              int size = 0;
              int ptr = 0;
 
              /* yes, grab the value and copy to its corresponding expansion variable */
-             while(*q && *q != ';')            /* ; terminates */
-               if (*q == '"')
+             p += mp->namelen;
+             while(*p && *p != ';')            /* ; terminates */
+               if (*p == '"')
                  {
-                 q++;                          /* skip leading " */
-                 plen++;                       /* and account for the skip */
-                 while(*q && *q != '"')        /* " protects ; */
-                   {
-                   param_value = string_cat(param_value, &size, &ptr, q++, 1);
-                   plen++;
-                   }
-                 if (*q)
-                   {
-                   q++;                        /* skip trailing " */
-                   plen++;
-                   }
+                 p++;                          /* skip leading " */
+                 while(*p && *p != '"')        /* " protects ; */
+                   param_value = string_cat(param_value, &size, &ptr, p++, 1);
+                 if (*p) p++;                  /* skip trailing " */
                  }
                else
-                 {
-                 param_value = string_cat(param_value, &size, &ptr, q++, 1);
-                 plen++;
-                 }
+                 param_value = string_cat(param_value, &size, &ptr, p++, 1);
+             if (*p) p++;                      /* skip trailing ; */
 
              if (param_value)
                {
+               uschar * dummy;
                param_value[ptr++] = '\0';
 
                param_value = rfc2047_decode(param_value,
-                     check_rfc2047_length, NULL, 32, NULL, &q);
+                     check_rfc2047_length, NULL, 32, NULL, &dummy);
                debug_printf("Found %s MIME parameter in %s header, "
                      "value is '%s'\n", mp->name, mime_header_list[i].name,
                      param_value);
                }
              *mp->value = param_value;
-             p += mp->namelen + plen + 1;      /* name=, content, ; */
              goto NEXT_PARAM_SEARCH;
            }
          }

diff --git a/test/confs/4000 b/test/confs/4000
index febe9a5e76e20624ba4f6020343ba8e074bb4af6..e1275c17d6abd567a508f601367e0dd61a22a4e9 100644 (file)
--- a/test/confs/4000
+++ b/test/confs/4000
@@ -8,6 +8,7 @@ spool_directory = DIR/spool
 log_file_path = DIR/spool/log/%slog
 gecos_pattern = ""
 gecos_name = CALLER_NAME
+log_selector = +subject
 
 
 # ----- Main settings -----

diff --git a/test/log/4000 b/test/log/4000
index a6f5d2f7089090f5b8a6e5ececdf40a34873b531..bd4918963fc372f694322fe9d9681163b7b4a4e4 100644 (file)
--- a/test/log/4000
+++ b/test/log/4000
@@ -1,9 +1,12 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=20041217133501.GA3058@test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=20041217133501.GA3058@test.ex T="[exim] Re: Bug#286074: eximstats: uses message count as data for\n      the \"volume\" charts"
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=20041217133501.GA3058@test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=20041217133501.GA3058@test.ex T="Nasty"
 1999-03-02 09:44:33 10HmaY-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=20041217133501.GA3059@test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=20041217133501.GA3059@test.ex T="Nasty"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=20041217133501.GA3059@test.ex T="Nasty3"
+1999-03-02 09:44:33 10HmbA-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed

diff --git a/test/mail/4000.userx b/test/mail/4000.userx
index 725770d6393a654032bc23c66f0cc0aaeff77d6b..81b21d224b6344bf806a7b905820a33d6eb41777 100644 (file)
--- a/test/mail/4000.userx
+++ b/test/mail/4000.userx
@@ -218,3 +218,39 @@ foobar
 
 --T4sUOijqQbZv57TR--
 
+From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
+Received: from CALLER (helo=test.ex)
+       by myhost.test.ex with local-esmtp (Exim x.yz)
+       (envelope-from <CALLER@myhost.test.ex>)
+       id 10HmbA-0005vi-00
+       for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+From: J Caesar <jcaesar@test.ex>
+To: a-list00@exim.org
+Message-ID: <20041217133501.GA3059@test.ex>
+Mime-Version: 1.0
+Content-Type: text/plain; charset="utf-8""
+Content-Disposition: inline
+Subject: Nasty3
+Sender: CALLER_NAME <CALLER@myhost.test.ex>
+X-0-content-type: text/plain
+X-0-filename: 
+X-0-charset: utf-8;
+X-0-boundary: 
+X-0-content-disposition: inline
+X-0-content-transfer-encoding: 
+X-0-content-id: 
+X-0-content-description: 
+X-0-is-multipart: 0
+X-0-is-coverletter: 1
+X-0-is-rfc822: 0
+X-0-decode-filename: TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00-00000
+X-0-content-size: 1
+
+--T4sUOijqQbZv57TR
+Content-Type: text/plain;
+
+foobar
+
+--T4sUOijqQbZv57TR--
+

diff --git a/test/scripts/4000-scanning/4000 b/test/scripts/4000-scanning/4000
index 2f760bca0b9d27a0e6253dd218eb4def4887c401..de175dec510fc98cf24db041b1678c9debaaeb9a 100644 (file)
--- a/test/scripts/4000-scanning/4000
+++ b/test/scripts/4000-scanning/4000
@@ -126,3 +126,30 @@ foobar
 .
 quit
 ****
+#
+#
+# This one has a 3rd rotten parameter style
+#
+exim -odi -bs
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+From: J Caesar <jcaesar@test.ex>
+To: a-list00@exim.org
+Message-ID: <20041217133501.GA3059@test.ex>
+Mime-Version: 1.0
+Content-Type: text/plain; charset="utf-8""
+Content-Disposition: inline
+Subject: Nasty3
+
+--T4sUOijqQbZv57TR
+Content-Type: text/plain;
+
+foobar
+
+--T4sUOijqQbZv57TR--
+.
+quit
+****

diff --git a/test/stdout/4000 b/test/stdout/4000
index 42d2eefc7acaf504ef697ae0e9e38b59a3c9e108..ae27f526e3e94ef8d5f934bd573322a919afbf84 100644 (file)
--- a/test/stdout/4000
+++ b/test/stdout/4000
@@ -31,3 +31,14 @@
 354 Enter message, ending with "." on a line by itself\r
 250 OK id=10HmaZ-0005vi-00\r
 221 myhost.test.ex closing connection\r
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000\r
+250-myhost.test.ex Hello CALLER at test.ex\r
+250-SIZE 52428800\r
+250-8BITMIME\r
+250-PIPELINING\r
+250 HELP\r
+250 OK\r
+250 Accepted\r
+354 Enter message, ending with "." on a line by itself\r
+250 OK id=10HmbA-0005vi-00\r
+221 myhost.test.ex closing connection\r