[Bug 3165] New: exim crashed on local SMTP if message_id_header_domain contains '-'

https://bugs.exim.org/show_bug.cgi?id=3165

            Bug ID: 3165
           Summary: exim crashed on local SMTP if message_id_header_domain
                    contains '-'
           Product: Exim
           Version: 4.98.2
          Hardware: x86
                OS: Linux
            Status: NEW
          Severity: bug
          Priority: medium
         Component: Mail Receipt
          Assignee: [email protected]
          Reporter: [email protected]
                CC: [email protected]

Created attachment 1516
  --> https://bugs.exim.org/attachment.cgi?id=1516&action=edit
A patch to resolv this bug

If message_id_header_domain is configured to be contain '-' (or any
non-alphanumeric characters except '.') and no '$' or '\', command "exim -oi
destination@domain" crashes locally.
In line 2842 of receice.c in expm 4.98.2, receive_msg() tries to modify the
content of id_domain. However, if message_id_header_domain is configured to be
contain '-', expand_string(message_id_domain) in line 2830 returns a string
which is located in an area which is set non-writable by mprotect() in store.c.
So exim causes SEGV here.
A patch attached.

-- 
You are receiving this mail because:
You are on the CC list for the bug.