65ef400c89
Upstream note:
* Bugfix (defect introduced: Postfix 2.3, date: 20050323): buffer
over-read when Postfix an enhanced status code is not followed
by other text. For example, "5.7.2" without text after the
three-number code. This CANNOT be triggered with an SMTP or
LMTP server response; is confirmed with an access(5) table and
likely with a policy server response; can possibly be triggered
with pipe-to-command output, header_checks(5), body_checks(5),
an error(8) transport in transport_maps, or a milter response;
and is confirmed with a DNSBL server TXT response while Postfix
is configured with "$rbl_code $rbl_text" in rbl_reply_maps or
default_rbl_reply. This could result in process termination.
Problem reported by Kamil Frankowicz.
Resolves-Vulnerability: CVE-2026-43964
Resolves: RHEL-176548
14 lines
481 B
Diff
14 lines
481 B
Diff
diff --git a/src/global/dsn_util.c b/src/global/dsn_util.c
|
|
index 52b997a..5751128 100644
|
|
--- a/src/global/dsn_util.c
|
|
+++ b/src/global/dsn_util.c
|
|
@@ -154,7 +154,7 @@ DSN_SPLIT *dsn_split(DSN_SPLIT *dp, const char *def_dsn, const char *text)
|
|
if ((len = dsn_valid(cp)) > 0) {
|
|
strncpy(dp->dsn.data, cp, len);
|
|
dp->dsn.data[len] = 0;
|
|
- cp += len + 1;
|
|
+ cp += len;
|
|
} else if ((len = dsn_valid(def_dsn)) > 0) {
|
|
strncpy(dp->dsn.data, def_dsn, len);
|
|
dp->dsn.data[len] = 0;
|