diff options
Diffstat (limited to 'gnu/packages/patches/exim-CVE-2017-16943.patch')
| -rw-r--r-- | gnu/packages/patches/exim-CVE-2017-16943.patch | 65 |
1 files changed, 0 insertions, 65 deletions
diff --git a/gnu/packages/patches/exim-CVE-2017-16943.patch b/gnu/packages/patches/exim-CVE-2017-16943.patch deleted file mode 100644 index 3a3e5d27fa..0000000000 --- a/gnu/packages/patches/exim-CVE-2017-16943.patch +++ /dev/null @@ -1,65 +0,0 @@ -Fix CVE-2017-16943: - -https://bugs.exim.org/show_bug.cgi?id=2199 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16943 - -Patch copied from upstream source repository: - -https://git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bde - -From 4090d62a4b25782129cc1643596dc2f6e8f63bde Mon Sep 17 00:00:00 2001 -From: Jeremy Harris <jgh146exb@wizmail.org> -Date: Fri, 24 Nov 2017 20:22:33 +0000 -Subject: [PATCH] Avoid release of store if there have been later allocations. - Bug 2199 - ---- - doc/doc-txt/ChangeLog | 4 ++++ - src/src/receive.c | 7 ++++--- - 2 files changed, 8 insertions(+), 3 deletions(-) - -#diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog -#index e937ba2..a2d9339 100644 -#--- a/doc/doc-txt/ChangeLog -#+++ b/doc/doc-txt/ChangeLog -#@@ -59,6 +59,10 @@ JH/30 Fix a logging bug on aarch64: an unsafe routine was previously used for -# connection in response to HELO" was logged instead of the actual 4xx -# error for the HELO. -# -#+JH/34 Bug 2199: fix a use-after-free while reading smtp input for header lines. -#+ A crafted sequence of BDAT commands could result in in-use memory beeing -#+ freed. -#+ -# - Exim version 4.89 - ----------------- -diff --git a/src/src/receive.c b/src/src/receive.c -index 95cf13e..20672db 100644 ---- a/src/receive.c -+++ b/src/receive.c -@@ -1772,8 +1772,8 @@ for (;;) - (and sometimes lunatic messages can have ones that are 100s of K long) we - call store_release() for strings that have been copied - if the string is at - the start of a block (and therefore the only thing in it, because we aren't -- doing any other gets), the block gets freed. We can only do this because we -- know there are no other calls to store_get() going on. */ -+ doing any other gets), the block gets freed. We can only do this release if -+ there were no allocations since the once that we want to free. */ - - if (ptr >= header_size - 4) - { -@@ -1782,9 +1782,10 @@ for (;;) - header_size *= 2; - if (!store_extend(next->text, oldsize, header_size)) - { -+ BOOL release_ok = store_last_get[store_pool] == next->text; - uschar *newtext = store_get(header_size); - memcpy(newtext, next->text, ptr); -- store_release(next->text); -+ if (release_ok) store_release(next->text); - next->text = newtext; - } - } --- -1.9.1 - |