Avoid crash with badly-terminated non-recognised mime parameter

diff --git a/src/src/mime.c b/src/src/mime.c
index e5fe476d0f8892aa04147259eec99be259bb42e2..948dd784818373c50ccdf7d33207bbeaf7772207 100644 (file)
--- a/src/src/mime.c
+++ b/src/src/mime.c
@@ -589,6 +589,7 @@ DECODE_HEADERS:
 NEXT_PARAM_SEARCH:
        while (*p)
          {
+         /* debug_printf("  considering paramlist '%s'\n", p); */
          mime_parameter * mp;
          for (mp = mime_parameter_list;
               mp < &mime_parameter_list[mime_parameter_list_size];
@@ -623,7 +624,7 @@ NEXT_PARAM_SEARCH:
 
                param_value = rfc2047_decode(param_value,
                      check_rfc2047_length, NULL, 32, NULL, &dummy);
-               debug_printf("Found %s MIME parameter in %s header, "
+               debug_printf(" Found %s MIME parameter in %s header, "
                      "value is '%s'\n", mp->name, mime_header_list[i].name,
                      param_value);
                }
@@ -631,14 +632,17 @@ NEXT_PARAM_SEARCH:
              goto NEXT_PARAM_SEARCH;
            }
          }
-         /* There is something, but not one of our interesting parameters.
-            Advance to the next semicolon */
-         while(*p != ';')
+       /* There is something, but not one of our interesting parameters.
+          Advance to the next unquoted semicolon */
+       while(*p && *p != ';')
+         if (*p == '"')
            {
-           if (*p == '"') while(*++p && *p != '"') ;
-           p++;
+           while(*++p && *p != '"') ;
+           if (*p) p++;
            }
-         p++;
+         else
+           p++;
+       if (*p) p++;
        }
       }
   }

diff --git a/test/log/4000 b/test/log/4000
index bd4918963fc372f694322fe9d9681163b7b4a4e4..e2c364fcad7293c50b08f66466779d4a047dd7da 100644 (file)
--- a/test/log/4000
+++ b/test/log/4000
@@ -10,3 +10,6 @@
 1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=20041217133501.GA3059@test.ex T="Nasty3"
 1999-03-02 09:44:33 10HmbA-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=20041217133501.GA3059@test.ex T="Nasty4"
+1999-03-02 09:44:33 10HmbB-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed

diff --git a/test/mail/4000.userx b/test/mail/4000.userx
index 81b21d224b6344bf806a7b905820a33d6eb41777..d362efd54ad16e7356cd19c28c51e785e72251a4 100644 (file)
--- a/test/mail/4000.userx
+++ b/test/mail/4000.userx
@@ -254,3 +254,45 @@ foobar
 
 --T4sUOijqQbZv57TR--
 
+From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
+Received: from CALLER (helo=test.ex)
+       by myhost.test.ex with local-esmtp (Exim x.yz)
+       (envelope-from <CALLER@myhost.test.ex>)
+       id 10HmbB-0005vi-00
+       for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+From: J Caesar <jcaesar@test.ex>
+To: a-list00@exim.org
+Message-ID: <20041217133501.GA3059@test.ex>
+Mime-Version: 1.0
+Content-Type: text/plain;
+        garbage1;
+        garbage2=foo;
+        garbage3="bar"foo;
+        charset=UTF-8;
+        garbage4=";
+        garbage5="
+Content-Disposition: inline
+Subject: Nasty4
+Sender: CALLER_NAME <CALLER@myhost.test.ex>
+X-0-content-type: text/plain
+X-0-filename: 
+X-0-charset: UTF-8
+X-0-boundary: 
+X-0-content-disposition: inline
+X-0-content-transfer-encoding: 
+X-0-content-id: 
+X-0-content-description: 
+X-0-is-multipart: 0
+X-0-is-coverletter: 1
+X-0-is-rfc822: 0
+X-0-decode-filename: TESTSUITE/spool/scan/10HmbB-0005vi-00/10HmbB-0005vi-00-00000
+X-0-content-size: 1
+
+--T4sUOijqQbZv57TR
+Content-Type: text/plain;
+
+foobar
+
+--T4sUOijqQbZv57TR--
+

diff --git a/test/scripts/4000-scanning/4000 b/test/scripts/4000-scanning/4000
index de175dec510fc98cf24db041b1678c9debaaeb9a..cd53007b2c872117f2ef581e7c301c7b91a8e8b2 100644 (file)
--- a/test/scripts/4000-scanning/4000
+++ b/test/scripts/4000-scanning/4000
@@ -153,3 +153,35 @@ foobar
 .
 quit
 ****
+#
+#
+# This one has a some unrecognised params
+#
+exim -odi -bs
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+From: J Caesar <jcaesar@test.ex>
+To: a-list00@exim.org
+Message-ID: <20041217133501.GA3059@test.ex>
+Mime-Version: 1.0
+Content-Type: text/plain;
+        garbage1;
+        garbage2=foo;
+        garbage3="bar"foo;
+        charset=UTF-8;
+        garbage4=";
+Content-Disposition: inline
+Subject: Nasty4
+
+--T4sUOijqQbZv57TR
+Content-Type: text/plain;
+
+foobar
+
+--T4sUOijqQbZv57TR--
+.
+quit
+****

diff --git a/test/stdout/4000 b/test/stdout/4000
index ae27f526e3e94ef8d5f934bd573322a919afbf84..24b8e28680227fe8e9d8d54cd2dd6ed06d0ec92f 100644 (file)
--- a/test/stdout/4000
+++ b/test/stdout/4000
@@ -42,3 +42,14 @@
 354 Enter message, ending with "." on a line by itself\r
 250 OK id=10HmbA-0005vi-00\r
 221 myhost.test.ex closing connection\r
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000\r
+250-myhost.test.ex Hello CALLER at test.ex\r
+250-SIZE 52428800\r
+250-8BITMIME\r
+250-PIPELINING\r
+250 HELP\r
+250 OK\r
+250 Accepted\r
+354 Enter message, ending with "." on a line by itself\r
+250 OK id=10HmbB-0005vi-00\r
+221 myhost.test.ex closing connection\r