4c9325d865
A malformed MIME structure with many parts can cause sendmail to crash while trying to send a mail due to a stack overflow, e.g., if the stack size is limited (ulimit -s). This happens because the recursion of the function mime8to7() was not restricted. The function is called for MIME 8 to 7 bit conversion and also to enforce MaxMimeHeaderLength. To work around this problem, recursive calls are limited to a depth of MAXMIMENESTING (20); message content after this limit is treated as opaque and is not checked further.
21 lines
812 B
Text
21 lines
812 B
Text
$NetBSD: patch-aj,v 1.1 2006/06/14 18:57:34 adrianp Exp $
|
|
|
|
--- sendmail/sendmail.h.orig 2006-06-13 21:35:58.000000000 +0100
|
|
+++ sendmail/sendmail.h
|
|
@@ -942,6 +942,7 @@ struct envelope
|
|
#define EF_TOOBIG 0x02000000L /* message is too big */
|
|
#define EF_SPLIT 0x04000000L /* envelope has been split */
|
|
#define EF_UNSAFE 0x08000000L /* unsafe: read from untrusted source */
|
|
+#define EF_TOODEEP 0x10000000L /* message is nested too deep */
|
|
|
|
#define DLVR_NOTIFY 0x01
|
|
#define DLVR_RETURN 0x02
|
|
@@ -1592,7 +1593,7 @@ EXTERN unsigned long PrivacyFlags; /* pr
|
|
|
|
/* functions */
|
|
extern bool mime7to8 __P((MCI *, HDR *, ENVELOPE *));
|
|
-extern int mime8to7 __P((MCI *, HDR *, ENVELOPE *, char **, int));
|
|
+extern int mime8to7 __P((MCI *, HDR *, ENVELOPE *, char **, int, int));
|
|
|
|
/*
|
|
** Flags passed to returntosender.
|