5b6861ce00
* The new ldap_require_cert option would segfault if used. Fixed. * Harmonised TLS library version reporting; only show if debugging. Layout now matches that introduced for other libraries in 4.74 PP/03. * New openssl_options items: no_sslv2 no_sslv3 no_ticket no_tlsv1 * New "dns_use_edns0" global option. * Don't segfault on misconfiguration of ref:name exim-user as uid. * Extra paranoia around buffer usage at the STARTTLS transition. nb: Exim is not vulnerable to http://www.kb.cert.org/vuls/id/555316 * Updated PolarSSL code to 0.14.2. * Catch divide-by-zero in ${eval:...}. * Condition negation of bool{}/bool_lax{} did not negate. Fixed. * CVE-2011-1764 - DKIM log line was subject to a format-string attack -- SECURITY: remote arbitrary code execution. * SECURITY - DKIM signature header parsing was double-expanded, second time unintentionally subject to list matching rules, letting the header cause arbitrary Exim lookups (of items which can occur in lists, *not* arbitrary string expansion). This allowed for information disclosure. * Fix another SIGFPE (x86) in ${eval:...} expansion, this time related to INT_MIN/-1 -- value coerced to INT_MAX.
103 lines
2.7 KiB
Text
103 lines
2.7 KiB
Text
$NetBSD: patch-ac,v 1.15 2011/05/09 13:30:47 adam Exp $
|
|
|
|
--- src/dns.c.orig 2011-05-09 08:36:25.000000000 +0000
|
|
+++ src/dns.c
|
|
@@ -168,26 +168,39 @@ Returns: nothing
|
|
void
|
|
dns_init(BOOL qualify_single, BOOL search_parents)
|
|
{
|
|
-if ((_res.options & RES_INIT) == 0)
|
|
+struct __res_state *rs;
|
|
+#ifdef __NetBSD__
|
|
+rs = __res_get_state();
|
|
+#else
|
|
+rs = &_res;
|
|
+#endif
|
|
+
|
|
+if ((rs->options & RES_INIT) == 0)
|
|
{
|
|
- DEBUG(D_resolver) _res.options |= RES_DEBUG; /* For Cygwin */
|
|
+ DEBUG(D_resolver) rs->options |= RES_DEBUG; /* For Cygwin */
|
|
+ #ifdef __NetBSD__
|
|
+ __res_put_state(rs);
|
|
+ #endif
|
|
res_init();
|
|
- DEBUG(D_resolver) _res.options |= RES_DEBUG;
|
|
+ DEBUG(D_resolver) rs->options |= RES_DEBUG;
|
|
+ #ifdef __NetBSD__
|
|
+ __res_put_state(rs);
|
|
+ #endif
|
|
}
|
|
|
|
-_res.options &= ~(RES_DNSRCH | RES_DEFNAMES);
|
|
-_res.options |= (qualify_single? RES_DEFNAMES : 0) |
|
|
+rs->options &= ~(RES_DNSRCH | RES_DEFNAMES);
|
|
+rs->options |= (qualify_single? RES_DEFNAMES : 0) |
|
|
(search_parents? RES_DNSRCH : 0);
|
|
-if (dns_retrans > 0) _res.retrans = dns_retrans;
|
|
-if (dns_retry > 0) _res.retry = dns_retry;
|
|
+if (dns_retrans > 0) rs->retrans = dns_retrans;
|
|
+if (dns_retry > 0) rs->retry = dns_retry;
|
|
|
|
#ifdef RES_USE_EDNS0
|
|
if (dns_use_edns0 >= 0)
|
|
{
|
|
if (dns_use_edns0)
|
|
- _res.options |= RES_USE_EDNS0;
|
|
+ rs->options |= RES_USE_EDNS0;
|
|
else
|
|
- _res.options &= ~RES_USE_EDNS0;
|
|
+ rs->options &= ~RES_USE_EDNS0;
|
|
DEBUG(D_resolver)
|
|
debug_printf("Coerced resolver EDNS0 support %s.\n",
|
|
dns_use_edns0 ? "on" : "off");
|
|
@@ -198,6 +211,10 @@ if (dns_use_edns0 >= 0)
|
|
debug_printf("Unable to %sset EDNS0 without resolver support.\n",
|
|
dns_use_edns0 ? "" : "un");
|
|
#endif
|
|
+
|
|
+#ifdef __NetBSD__
|
|
+__res_put_state(rs);
|
|
+#endif
|
|
}
|
|
|
|
|
|
@@ -442,9 +459,15 @@ Returns: the return code
|
|
static int
|
|
dns_return(uschar *name, int type, int rc)
|
|
{
|
|
+struct __res_state *rs;
|
|
+#ifdef __NetBSD__
|
|
+rs = __res_get_state();
|
|
+#else
|
|
+rs = &_res;
|
|
+#endif
|
|
tree_node *node = store_get_perm(sizeof(tree_node) + 290);
|
|
sprintf(CS node->name, "%.255s-%s-%lx", name, dns_text_type(type),
|
|
- _res.options);
|
|
+ rs->options);
|
|
node->data.val = rc;
|
|
(void)tree_insertnode(&tree_dns_fails, node);
|
|
return rc;
|
|
@@ -484,6 +507,12 @@ dns_basic_lookup(dns_answer *dnsa, uscha
|
|
int rc = -1;
|
|
uschar *save;
|
|
#endif
|
|
+struct __res_state *rs;
|
|
+#ifdef __NetBSD__
|
|
+rs = __res_get_state();
|
|
+#else
|
|
+rs = &_res;
|
|
+#endif
|
|
|
|
tree_node *previous;
|
|
uschar node_name[290];
|
|
@@ -494,7 +523,7 @@ have many addresses in the same domain.
|
|
caching for successful lookups. */
|
|
|
|
sprintf(CS node_name, "%.255s-%s-%lx", name, dns_text_type(type),
|
|
- _res.options);
|
|
+ rs->options);
|
|
previous = tree_search(tree_dns_fails, node_name);
|
|
if (previous != NULL)
|
|
{
|