[PATCH] qmail-qfilter bounds issue

The attached patch addresses two issues encountered recently on a fairly
heavily loaded mail server.

The first issue is really a valgrind problem, but it's still in my
patch and does no harm.  Valgrind was not reporting correctly when
the first strlen() in parse_sender() referenced ptr, but I was able
to shut it up by referencing env instead.

In the second case, if a filter modifies the envelope/message, then
move_unless_empty() will call parse_envelope() before assigning the
new length to *var, so the mmap() call in parse_envelope() will use
the unmodified envelope/message length.

thanks.
--
-dale


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

--- qmail-qfilter.c	Tue Nov 23 23:47:06 2004
+++ qmail-qfilter.c	Thu Aug  4 11:56:51 2005
@@ -90,7 +90,7 @@
 {
   const char* ptr = env;
   char* at;
-  size_t len = strlen(ptr);
+  size_t len = strlen(env);
   
   if(*ptr != 'F')
     exit(QQ_BAD_ENV);
@@ -258,12 +258,12 @@
     exit(QQ_INTERNAL);
   if (st.st_size > 0) {
     move_fd(src, dst);
+    *var = st.st_size;
     if (reopen) {
       mktmpfd(src);
       if (src == ENVOUT)
 	parse_envelope();
     }
-    *var = st.st_size;
   }
   else
     if (!reopen)