os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
doc/website/static/security/patches/SA-03:04/sendmail.patch
Sergio Carlavilla Delgado 989d921f5d Migrate doc to Hugo/AsciiDoctor 
I'm very pleased to announce the release of
our new website and documentation using
the new toolchain with Hugo and AsciiDoctor.

To get more information about the new toolchain
please read the FreeBSD Documentation Project Primer[1],
Hugo docs[2] and AsciiDoctor docs[3].

Acknowledgment:
Benedict Reuschling <bcr@>
Glen Barber <gjb@>
Hiroki Sato <hrs@>
Li-Wen Hsu <lwhsu@>
Sean Chittenden <seanc@>
The FreeBSD Foundation

[1] https://docs.FreeBSD.org/en/books/fdp-primer/
[2] https://gohugo.io/documentation/
[3] https://docs.asciidoctor.org/home/

Approved by:    doceng, core
2021-01-26 00:31:29 +01:00

497 lines
12 KiB
Diff
Raw Blame History

Index: contrib/sendmail/src/daemon.c
===================================================================
RCS file: /home/ncvs/src/contrib/sendmail/src/daemon.c,v
retrieving revision 1.1.1.3.2.10
diff -u -r1.1.1.3.2.10 daemon.c
--- contrib/sendmail/src/daemon.c 27 Jun 2002 20:43:21 -0000 1.1.1.3.2.10
+++ contrib/sendmail/src/daemon.c 27 Feb 2003 21:42:35 -0000
@@ -3508,7 +3508,7 @@
if (i < 0 || p == &ibuf[0])
goto noident;
- if (*--p == '\n' && *--p == '\r')
+ if (p >= &ibuf[2] && *--p == '\n' && *--p == '\r')
p--;
*++p = '\0';
Index: contrib/sendmail/src/headers.c
===================================================================
RCS file: /home/ncvs/src/contrib/sendmail/src/headers.c,v
retrieving revision 1.4.2.7
diff -u -r1.4.2.7 headers.c
--- contrib/sendmail/src/headers.c 3 Sep 2002 01:50:17 -0000 1.4.2.7
+++ contrib/sendmail/src/headers.c 27 Feb 2003 21:42:36 -0000
@@ -678,8 +678,8 @@
if (buf[0] != '\0')
{
if (bitset(H_FROM, h->h_flags))
- expand(crackaddr(buf), buf, sizeof buf,
- e);
+ expand(crackaddr(buf, e),
+ buf, sizeof buf, e);
h->h_value = sm_rpool_strdup_x(e->e_rpool, buf);
h->h_flags &= ~H_DEFAULT;
}
@@ -1000,7 +1000,11 @@
** it and replaces it with "$g". The parse is totally ad hoc
** and isn't even guaranteed to leave something syntactically
** identical to what it started with. However, it does leave
-** something semantically identical.
+** something semantically identical if possible, else at least
+** syntactically correct.
+**
+** For example, it changes "Real Name <real@example.com> (Comment)"
+** to "Real Name <$g> (Comment)".
**
** This algorithm has been cleaned up to handle a wider range
** of cases -- notably quoted and backslash escaped strings.
@@ -1009,6 +1013,7 @@
**
** Parameters:
** addr -- the address to be cracked.
+** e -- the current envelope.
**
** Returns:
** a pointer to the new version.
@@ -1021,28 +1026,50 @@
** be copied if it is to be reused.
*/
+#define SM_HAVE_ROOM ((bp < buflim) && (buflim <= bufend))
+
+/*
+** Append a character to bp if we have room.
+** If not, punt and return $g.
+*/
+
+#define SM_APPEND_CHAR(c) \
+ do \
+ { \
+ if (SM_HAVE_ROOM) \
+ *bp++ = (c); \
+ else \
+ goto returng; \
+ } while (0)
+
+#if MAXNAME < 10
+ERROR MAXNAME must be at least 10
+#endif /* MAXNAME < 10 */
+
char *
-crackaddr(addr)
+crackaddr(addr, e)
register char *addr;
+ ENVELOPE *e;
{
register char *p;
register char c;
- int cmtlev;
- int realcmtlev;
- int anglelev, realanglelev;
- int copylev;
- int bracklev;
- bool qmode;
- bool realqmode;
- bool skipping;
- bool putgmac = false;
- bool quoteit = false;
- bool gotangle = false;
- bool gotcolon = false;
+ int cmtlev; /* comment level in input string */
+ int realcmtlev; /* comment level in output string */
+ int anglelev; /* angle level in input string */
+ int copylev; /* 0 == in address, >0 copying */
+ int bracklev; /* bracket level for IPv6 addr check */
+ bool addangle; /* put closing angle in output */
+ bool qmode; /* quoting in original string? */
+ bool realqmode; /* quoting in output string? */
+ bool putgmac = false; /* already wrote $g */
+ bool quoteit = false; /* need to quote next character */
+ bool gotangle = false; /* found first '<' */
+ bool gotcolon = false; /* found a ':' */
register char *bp;
char *buflim;
char *bufhead;
char *addrhead;
+ char *bufend;
static char buf[MAXNAME + 1];
if (tTd(33, 1))
@@ -1057,25 +1084,22 @@
** adjusted later if we find them.
*/
+ buflim = bufend = &buf[sizeof(buf) - 1];
bp = bufhead = buf;
- buflim = &buf[sizeof buf - 7];
p = addrhead = addr;
- copylev = anglelev = realanglelev = cmtlev = realcmtlev = 0;
+ copylev = anglelev = cmtlev = realcmtlev = 0;
bracklev = 0;
- qmode = realqmode = false;
+ qmode = realqmode = addangle = false;
while ((c = *p++) != '\0')
{
/*
- ** If the buffer is overful, go into a special "skipping"
- ** mode that tries to keep legal syntax but doesn't actually
- ** output things.
+ ** Try to keep legal syntax using spare buffer space
+ ** (maintained by buflim).
*/
- skipping = bp >= buflim;
-
- if (copylev > 0 && !skipping)
- *bp++ = c;
+ if (copylev > 0)
+ SM_APPEND_CHAR(c);
/* check for backslash escapes */
if (c == '\\')
@@ -1090,8 +1114,8 @@
p--;
goto putg;
}
- if (copylev > 0 && !skipping)
- *bp++ = c;
+ if (copylev > 0)
+ SM_APPEND_CHAR(c);
goto putg;
}
@@ -1099,8 +1123,14 @@
if (c == '"' && cmtlev <= 0)
{
qmode = !qmode;
- if (copylev > 0 && !skipping)
+ if (copylev > 0 && SM_HAVE_ROOM)
+ {
+ if (realqmode)
+ buflim--;
+ else
+ buflim++;
realqmode = !realqmode;
+ }
continue;
}
if (qmode)
@@ -1112,15 +1142,15 @@
cmtlev++;
/* allow space for closing paren */
- if (!skipping)
+ if (SM_HAVE_ROOM)
{
buflim--;
realcmtlev++;
if (copylev++ <= 0)
{
if (bp != bufhead)
- *bp++ = ' ';
- *bp++ = c;
+ SM_APPEND_CHAR(' ');
+ SM_APPEND_CHAR(c);
}
}
}
@@ -1130,7 +1160,7 @@
{
cmtlev--;
copylev--;
- if (!skipping)
+ if (SM_HAVE_ROOM)
{
realcmtlev--;
buflim++;
@@ -1141,7 +1171,7 @@
else if (c == ')')
{
/* syntax error: unmatched ) */
- if (copylev > 0 && !skipping)
+ if (copylev > 0 && SM_HAVE_ROOM)
bp--;
}
@@ -1159,7 +1189,7 @@
/*
** Check for DECnet phase IV ``::'' (host::user)
- ** or ** DECnet phase V ``:.'' syntaxes. The latter
+ ** or DECnet phase V ``:.'' syntaxes. The latter
** covers ``user@DEC:.tay.myhost'' and
** ``DEC:.tay.myhost::user'' syntaxes (bletch).
*/
@@ -1168,10 +1198,10 @@
{
if (cmtlev <= 0 && !qmode)
quoteit = true;
- if (copylev > 0 && !skipping)
+ if (copylev > 0)
{
- *bp++ = c;
- *bp++ = *p;
+ SM_APPEND_CHAR(c);
+ SM_APPEND_CHAR(*p);
}
p++;
goto putg;
@@ -1182,41 +1212,43 @@
bp = bufhead;
if (quoteit)
{
- *bp++ = '"';
+ SM_APPEND_CHAR('"');
/* back up over the ':' and any spaces */
--p;
- while (isascii(*--p) && isspace(*p))
+ while (p > addr &&
+ isascii(*--p) && isspace(*p))
continue;
p++;
}
for (q = addrhead; q < p; )
{
c = *q++;
- if (bp < buflim)
+ if (quoteit && c == '"')
{
- if (quoteit && c == '"')
- *bp++ = '\\';
- *bp++ = c;
+ SM_APPEND_CHAR('\\');
+ SM_APPEND_CHAR(c);
}
+ else
+ SM_APPEND_CHAR(c);
}
if (quoteit)
{
if (bp == &bufhead[1])
bp--;
else
- *bp++ = '"';
+ SM_APPEND_CHAR('"');
while ((c = *p++) != ':')
- {
- if (bp < buflim)
- *bp++ = c;
- }
- *bp++ = c;
+ SM_APPEND_CHAR(c);
+ SM_APPEND_CHAR(c);
}
/* any trailing white space is part of group: */
- while (isascii(*p) && isspace(*p) && bp < buflim)
- *bp++ = *p++;
+ while (isascii(*p) && isspace(*p))
+ {
+ SM_APPEND_CHAR(*p);
+ p++;
+ }
copylev = 0;
putgmac = quoteit = false;
bufhead = bp;
@@ -1225,10 +1257,7 @@
}
if (c == ';' && copylev <= 0 && !ColonOkInAddr)
- {
- if (bp < buflim)
- *bp++ = c;
- }
+ SM_APPEND_CHAR(c);
/* check for characters that may have to be quoted */
if (strchr(MustQuoteChars, c) != NULL)
@@ -1256,42 +1285,45 @@
/* oops -- have to change our mind */
anglelev = 1;
- if (!skipping)
- realanglelev = 1;
+ if (SM_HAVE_ROOM)
+ {
+ if (!addangle)
+ buflim--;
+ addangle = true;
+ }
bp = bufhead;
if (quoteit)
{
- *bp++ = '"';
+ SM_APPEND_CHAR('"');
/* back up over the '<' and any spaces */
--p;
- while (isascii(*--p) && isspace(*p))
+ while (p > addr &&
+ isascii(*--p) && isspace(*p))
continue;
p++;
}
for (q = addrhead; q < p; )
{
c = *q++;
- if (bp < buflim)
+ if (quoteit && c == '"')
{
- if (quoteit && c == '"')
- *bp++ = '\\';
- *bp++ = c;
+ SM_APPEND_CHAR('\\');
+ SM_APPEND_CHAR(c);
}
+ else
+ SM_APPEND_CHAR(c);
}
if (quoteit)
{
if (bp == &buf[1])
bp--;
else
- *bp++ = '"';
+ SM_APPEND_CHAR('"');
while ((c = *p++) != '<')
- {
- if (bp < buflim)
- *bp++ = c;
- }
- *bp++ = c;
+ SM_APPEND_CHAR(c);
+ SM_APPEND_CHAR(c);
}
copylev = 0;
putgmac = quoteit = false;
@@ -1303,13 +1335,14 @@
if (anglelev > 0)
{
anglelev--;
- if (!skipping)
+ if (SM_HAVE_ROOM)
{
- realanglelev--;
- buflim++;
+ if (addangle)
+ buflim++;
+ addangle = false;
}
}
- else if (!skipping)
+ else if (SM_HAVE_ROOM)
{
/* syntax error: unmatched > */
if (copylev > 0)
@@ -1318,7 +1351,7 @@
continue;
}
if (copylev++ <= 0)
- *bp++ = c;
+ SM_APPEND_CHAR(c);
continue;
}
@@ -1326,30 +1359,42 @@
putg:
if (copylev <= 0 && !putgmac)
{
- if (bp > bufhead && bp[-1] == ')')
- *bp++ = ' ';
- *bp++ = MACROEXPAND;
- *bp++ = 'g';
+ if (bp > buf && bp[-1] == ')')
+ SM_APPEND_CHAR(' ');
+ SM_APPEND_CHAR(MACROEXPAND);
+ SM_APPEND_CHAR('g');
putgmac = true;
}
}
/* repair any syntactic damage */
- if (realqmode)
+ if (realqmode && bp < bufend)
*bp++ = '"';
- while (realcmtlev-- > 0)
+ while (realcmtlev-- > 0 && bp < bufend)
*bp++ = ')';
- while (realanglelev-- > 0)
+ if (addangle && bp < bufend)
*bp++ = '>';
- *bp++ = '\0';
+ *bp = '\0';
+ if (bp < bufend)
+ goto success;
+
+ returng:
+ /* String too long, punt */
+ buf[0] = '<';
+ buf[1] = MACROEXPAND;
+ buf[2]= 'g';
+ buf[3] = '>';
+ buf[4]= '\0';
+ sm_syslog(LOG_ALERT, e->e_id,
+ "Dropped invalid comments from header address");
+ success:
if (tTd(33, 1))
{
sm_dprintf("crackaddr=>`");
xputs(buf);
sm_dprintf("'\n");
}
-
return buf;
}
/*
Index: contrib/sendmail/src/main.c
===================================================================
RCS file: /home/ncvs/src/contrib/sendmail/src/main.c,v
retrieving revision 1.1.1.3.2.12
diff -u -r1.1.1.3.2.12 main.c
--- contrib/sendmail/src/main.c 3 Sep 2002 01:50:17 -0000 1.1.1.3.2.12
+++ contrib/sendmail/src/main.c 27 Feb 2003 21:42:36 -0000
@@ -4227,7 +4227,7 @@
"Usage: /parse address\n");
return;
}
- q = crackaddr(p);
+ q = crackaddr(p, e);
(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
"Cracked address = ");
xputs(q);
Index: contrib/sendmail/src/parseaddr.c
===================================================================
RCS file: /home/ncvs/src/contrib/sendmail/src/parseaddr.c,v
retrieving revision 1.1.1.2.6.10
diff -u -r1.1.1.2.6.10 parseaddr.c
--- contrib/sendmail/src/parseaddr.c 3 Sep 2002 01:50:18 -0000 1.1.1.2.6.10
+++ contrib/sendmail/src/parseaddr.c 27 Feb 2003 21:42:37 -0000
@@ -2508,7 +2508,7 @@
if (bitset(RF_CANONICAL, flags) || bitnset(M_NOCOMMENT, m->m_flags))
fancy = "\201g";
else
- fancy = crackaddr(name);
+ fancy = crackaddr(name, e);
/*
** Turn the name into canonical form.
Index: contrib/sendmail/src/sendmail.h
===================================================================
RCS file: /home/ncvs/src/contrib/sendmail/src/sendmail.h,v
retrieving revision 1.1.1.4.2.12
diff -u -r1.1.1.4.2.12 sendmail.h
--- contrib/sendmail/src/sendmail.h 3 Sep 2002 01:50:19 -0000 1.1.1.4.2.12
+++ contrib/sendmail/src/sendmail.h 27 Feb 2003 21:42:38 -0000
@@ -325,7 +325,7 @@
/* functions */
extern void cataddr __P((char **, char **, char *, int, int));
-extern char *crackaddr __P((char *));
+extern char *crackaddr __P((char *, ENVELOPE *));
extern bool emptyaddr __P((ADDRESS *));
extern ADDRESS *getctladdr __P((ADDRESS *));
extern int include __P((char *, bool, ADDRESS *, ADDRESS **, int, ENVELOPE *));
Reference in a new issue View git blame Copy permalink