[exim/exim] [Bug]: smtp transport outbuffer[4096] too small for XOAUTH2 AUTH commands, causes fatal "overlong write_command" (Issue #3208)

-------
Summary
-------

The smtp transport's outgoing command buffer ( outbuffer[4096] in
src/transports/smtp.h ) is too small for modern XOAUTH2 AUTH commands
with Microsoft Azure AD tokens. When the formatted AUTH command exceeds
4096 bytes, smtp_write_command() calls log_write_die() with
"overlong write_command in outgoing SMTP", killing the transport process.
This affects approximately 10% of Microsoft 365 / Outlook users whose
Azure AD tenants produce larger JWT tokens (due to group memberships,
app roles, and custom claims).

------------------
Steps to Reproduce
------------------

* 

Configure a plaintext authenticator for XOAUTH2 client authentication:
xoauth: driver = plaintext public_name = XOAUTH2 client_send = <SASL_XOAUTH2_payload> : :

* 

Authenticate to smtp-mail.outlook.com:587 with an Azure AD OAuth2
token where the decoded SASL payload exceeds ~3000 bytes
(base64-encoded > 4096 bytes).

* 

Exim crashes the transport process:
overlong write_command in outgoing SMTP got 0 of 7 bytes (pipeheader) from transport process NNNNNN for transport smtp smtp transport process returned non-zero status 0x0100: exit code 1

--------
Analysis
--------

In smtp_out.c , function smtp_write_command() :

gstring gs = { . size = big_buffer_size , . ptr = 0 , . s = big_buffer };
// ...
if ( gs. ptr > outblock -> buffersize )
   log_write_die ( 0 , LOG_MAIN , "overlong write_command in outgoing SMTP" );
outblock -> buffersize is sizeof ( sx -> outbuffer ) = 4096 , defined in src / transports / smtp. h :

#define DELIVER_BUFFER_SIZE 4096
// ...
uschar outbuffer [ 4096 ];
The full AUTH command is : AUTH XOAUTH2 ( 14 bytes ) + base64 token + \ r \ n ( 2 bytes ). With a typical Azure AD JWT token of ~ 3056 decoded bytes , the base64 encoding produces ~ 4136 bytes , making the total command ~ 4152 bytes — exceeding the 4096 buffer.

SASL continuation ( sending token after 334 challenge ) does not help because continuation responses also go through smtp_write_command () and are subject to the same buffer limit. A base64 payload of 4136 + 2 bytes CRLF = 4138 bytes still exceeds 4096.

Note that the incoming SMTP command buffer ( SMTP_CMD_BUFFER_SIZE ) is already 16384 bytes , and RFC 4954 recommends 12288 bytes minimum for AUTH exchanges.

Observed boundary
Token 3000 bytes decoded → base64 ~ 4000 → fits in 4096 → works ( gets normal 535 )
Token 3056 bytes decoded → base64 4136 → AUTH line 4152 → exceeds 4096 → crash
Token 3100 bytes decoded → base64 ~ 4136 → crash
Environment
Exim 4.98.2 and 4.99.1 ( all versions affected , verified in current master )
Rocky Linux 9 / x86_64
Authenticating as client to smtp - mail. outlook. com via XOAUTH2
Microsoft Azure AD JWT tokens ( size varies per tenant configuration )
Similar issues in other software
Roundcube / Net_SMTP : roundcube / roundcubemail # 8623 — fixed with SASL continuation
Dovecot : "500 5.5.2 Line too long" — fixed by increasing server - side limits
Postfix : has runtime - configurable line_length_limit
Proposed fix
Increase outbuffer in src / transports / smtp. h to match the incoming buffer size :

uschar outbuffer [ 16384 ];  // was 4096
This adds 12 KB per SMTP connection — negligible for modern systems , and consistent with RFC 4954 ' s recommendation of 12288 bytes for AUTH data and the existing incoming buffer of 16384.

Alternatively , the buffer could be dynamically allocated when an AUTH exchange requires it , but a simple size increase is the minimal safe fix.

Workaround
Rebuild Exim from source with the above one - line change.

---
View it on Exim Forgejo ( https://code.exim.org/exim/exim/issues/3208 ) or reply to this email directly.

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-dev.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki