spamassassin/SOURCES/spamassassin-3.4.2-fix-CVE-...

26 lines
945 B
Diff

diff -urp Mail-SpamAssassin-3.4.2/lib/Mail/SpamAssassin/Message.pm Mail-SpamAssassin-3.4.2.new/lib/Mail/SpamAssassin/Message.pm
--- Mail-SpamAssassin-3.4.2/lib/Mail/SpamAssassin/Message.pm 2018-09-14 03:27:51.000000000 +0200
+++ Mail-SpamAssassin-3.4.2.new/lib/Mail/SpamAssassin/Message.pm 2020-04-09 15:17:34.300986337 +0200
@@ -876,6 +876,7 @@ sub _parse_multipart {
my $header;
my $part_array;
my $found_end_boundary;
+ my $partcnt = 0;
my $line_count = @{$body};
foreach ( @{$body} ) {
@@ -948,6 +949,13 @@ sub _parse_multipart {
}
}
+ # Maximum parts to process
+ if (++$partcnt == 1000) {
+ dbg("message: mimepart limit exceeded, stopping parsing");
+ $self->{'mimepart_limit_exceeded'} = 1;
+ return;
+ }
+
# make sure we start with a new clean node
$in_body = 0;
$part_msg = Mail::SpamAssassin::Message::Node->new({ normalize=>$self->{normalize} });