Re: Exim 4.100-RC2 released

Mike Cardwell via Exim-users <[email protected]> Fri, 07 Aug 2026 14:13:12 +0200
Newsgroups	gmane.mail.exim.user
Message-ID	<[email protected]>
Hi,

It looks like you don't accept LLM submissions, but I pointed Claude at
4.100 and asked it to find problems that have been introduced since
4.99. Here are a couple of the things that it found, which I tested and
which look legit to me. Take it or leave it, I don't care about
attribution:

=======================================================================
1. Privilege escalation. On exim 4.99 none of these gave you full debug
output for a non privileged user:

exim -d -bt [email protected]
exim -d=0xffffffffffffffff -bt [email protected]
exim -d=0xfffffffffffffffb -bt [email protected]

On exim 4.100, the third one does.
=======================================================================
2. Heap overflow. Checked with valgrind:

It needs the header reference to be the first item in an expansion
string, with something following it. For example, in an ACL:

  warn  log_message = $h_subject: seen from $h_from:

Send a message with an ordinary Subject (no RFC 2047 encoded-word)
whose length is not a multiple of 128. Under valgrind:

  Invalid write of size 1
     by string_catn (string.c:1302)
     by expand_string_internal (expand.c:4906)
     by acl_check_condition (acl.c:4285)

find_header() passes back, via newsize, the size of the block the
returned pointer lives in, and the caller at expand.c:4998 adopts that
pointer as the expansion accumulator instead of copying it. At
expand.c:1733 the RFC 2047 decode result is now wrapped in
string_copy(), which allocates exactly strlen+1, while newsize still
holds the 128-byte-rounded gstring size from earlier in find_header().
The next append trusts the larger figure, skips the grow, and writes
past the end.

Consistent with that, a Subject of exactly 128 bytes (zero rounding
gap) does not overflow, and 129 bytes does.
=======================================================================

I'll maybe investigate the other things it found, if this email (and my
use of an LLM to find the problems) is considered useful.

Mike

On Wed, 2026-08-05 at 14:33 +0100, Bernard Quatermass via Exim-users
wrote:
> Hi everybody,
> 
> The RC rollercoaster continues its journey.
> 
> Thanks to everyone who commented on RC1
> 
> 
> This release candidate v4.100-RC2 is available as
> 
>   * tarball: https://ftp.exim.org/pub/exim/exim4/test
>   * directly from Git: https://code.exim.org/exim/exim
>     tag: exim-4.100-RC2
> 
> The signatures on the release candidate tarballs should be
> 
>   *  key ID 0xBCE58C8CE41F32DF
>      Email: [email protected]
> 
> Please test and give feedback on the RC so that we can shake out
> issues before 4.100 goes official.
> 
> The sourcebase is now closed for feature additions at this point in
> the release process.
> 
> 
>   * Changes since 4.100RC1
> 
> Fixes.
> 
>   * Various compiler quietening
>   * Update GPL doc references
>   * clear $spam_* variables on SMTP RST
>   * Proxy Protocol: add timeout guard to V2 input.  Bug 2957
>   * Proxy Protocol: move startup before remote-host policy checks. 
> Bug 3221
>   * DMARC: native implementation: use a-label of 5322.From
>   * Reject tainted format for internal printf
> 
> 
>    --
> 
> Reminder of Forthcoming Release Procedures Changes
> 
> Following the release of 4.100 we will change to releasing only 4.yyy
> and 4.yyy.zz
> releases on the master branch.
> 
> Intermediate work such as general bug fixing and feature enhancement
> will
> move to the 4.next branch.  We will endeavour to apply any .zz
> security
> fixes to the 4.next branch in a timely manner though there may be
> some lag.
> 
> Release candidates for 4.yyy+1 (4.101 onwards) will be tagged on the
> 4.next branch.
> 
>    --
> 
> 
> New stuff added since 4.99
> 
>   1. Lookups "psl" and "regdom" for, respectively, the public suffix
> or the
>      registered domain, given a domain and a Public Suffix List file.
> 
>   2. EXPERIMENTAL_DMARC_NATIVE optional build feature.  See the
> experimental.spec
>      file.
> 
>   3. Log selectors "spf", "spf_verbose", "dmarc", "dmarc_verbose",
> "dsn".
> 
>   4. Commandline option "-bI:modules" for listing installed dynamic-
> load modules.
> 
>   5. Debug channels "start", "regex" and "macro".
> 
>   6. The exiwhat utility now includes, on the daemon process line,
> counts for
>      smtp and queue-run children.
> 
>   7. Main config option "bounce_charset", for setting Content-type:
> headers.
> 
>   8. Event "proc:deliver".
> 
>   9. Commandline option "-oDSN" for DSN options on commandline
> sourced messages.
> 
> 10. Nongreedy wildcards for local_parts affixes.
> 
> 11. Main config option "queue_run_order", obsoleting
> "queue_run_in_order".
> 
> 12. The redirection router options "forbid_*" and "allow_filter" are
> now
>      expanded before use.
> 
> 
> Removed items since 4.99
> 
> * removed obsolete malware scanners
> * * f-prot6
> * * f-prot6d
> * * sophie
> * * drweb
> * * f-secur
> * * aveserver
> * * kavdaemon
> * * mksd
> 
> * removed Interbase support
> * removed Brightmail support
> 
>    --
> 
> Security related.
> 
> This candidate contains all the previous fixes issues released in
> 4.99.1 through 4.99.5
> 
>    --
> 
> Notable bugfixes include
> 
> * Expansion-test mode with debug (exim -d -be) now shows macro
> expansions.
> * Fix local deliveries. A mistaken optimisation done for 4.99 caused
>        excessive retries on defers
> * Fix radius expansion condition
> * Fix use of a verify held-open connection
> * Fix DNS lookups from perl on nonstandard port
> * Fix DMARC for empty envelope senders
> * Fix GnuTLS hostname verify of a server certificate with a zero-
> length Subject
> 
> Please refer to the ChangeLog file for a complete list.
> 
> 
> File Verification:
> 
> SIZE(00-sha256sums.txt)= 1869
> SIZE(00-sha512sums.txt)= 3021
> SIZE(00-sizes.txt)= 798
> SIZE(exim-4.100-RC2.tar.bz2)= 2183994
> SIZE(exim-4.100-RC2.tar.gz)= 2750808
> SIZE(exim-4.100-RC2.tar.xz)= 2007164
> SIZE(exim-html-4.100-RC2.tar.bz2)= 651374
> SIZE(exim-html-4.100-RC2.tar.gz)= 901928
> SIZE(exim-html-4.100-RC2.tar.xz)= 639524
> SIZE(exim-info-4.100-RC2.tar.bz2)= 485401
> SIZE(exim-info-4.100-RC2.tar.gz)= 653699
> SIZE(exim-info-4.100-RC2.tar.xz)= 486968
> SIZE(exim-pdf-4.100-RC2.tar.bz2)= 2219751
> SIZE(exim-pdf-4.100-RC2.tar.gz)= 2250554
> SIZE(exim-pdf-4.100-RC2.tar.xz)= 2183164
> SIZE(exim-postscript-4.100-RC2.tar.bz2)= 1171709
> SIZE(exim-postscript-4.100-RC2.tar.gz)= 1572466
> SIZE(exim-postscript-4.100-RC2.tar.xz)= 1161660
> SIZE(exim-texinfo-4.100-RC2.tar.bz2)= 459183
> SIZE(exim-texinfo-4.100-RC2.tar.gz)= 614444
> SIZE(exim-texinfo-4.100-RC2.tar.xz)= 462148
> 
> SHA2-256(00-sha256sums.txt)=
> cb2b3cdc88dd64a8d7a535d1070f0171ac59207c72d5f83c9863b6d483111768
> SHA2-256(00-sha512sums.txt)=
> f147cab239ceea647151cb143e8827b1c2518c57c78798a87fb0dfb8775b003c
> SHA2-256(00-sizes.txt)=
> b12b0b0c307e50109b090f078285614308e43a446330995ebf213cbc641f67df
> SHA2-256(exim-4.100-RC2.tar.bz2)=
> 97cc24529ed59bab944fd724d7f96f851b309f327d7f95c764a74426d69a1ba5
> SHA2-256(exim-4.100-RC2.tar.gz)=
> 5c721f75e4abca1bda61cece168107f442d48da40a65ecf511194c02311fd463
> SHA2-256(exim-4.100-RC2.tar.xz)=
> 6ab8bf8a341265a78d35a4b2a8262b531fc219bd8d07b6dfb3515a32a4f78e55
> SHA2-256(exim-html-4.100-RC2.tar.bz2)=
> 79bcba72ffd57453cbe386131b3e4e15528414faa7df279ba2557c45aaf68108
> SHA2-256(exim-html-4.100-RC2.tar.gz)=
> 188e4f2cb4e9921b29bbbb8914bf8d7b1d62ef524799f519ff55e1df0abf8ffb
> SHA2-256(exim-html-4.100-RC2.tar.xz)=
> 8e631705d3fd2ba47c874d89113b7512cf4d300d89387808c723e6400dbf2d36
> SHA2-256(exim-info-4.100-RC2.tar.bz2)=
> c74e14220e7ed1e95105e32540efc5aed203d771b25898bfbb8d05ace52c1834
> SHA2-256(exim-info-4.100-RC2.tar.gz)=
> fd7771d78cacae906a294547bd2c07882f6807a6d68d3509ccd2d8e16f3913d5
> SHA2-256(exim-info-4.100-RC2.tar.xz)=
> 5b685511a3902c04c4610b6112fd36a8e8ef08f0aa4fa5e2f239442949e0a08a
> SHA2-256(exim-pdf-4.100-RC2.tar.bz2)=
> 188d606188421c3ac91ef35613030369fff2fde02142c7fa873e194cefbdbbda
> SHA2-256(exim-pdf-4.100-RC2.tar.gz)=
> 56498dbfbf85c097d93ee5b0ac18e3004a749de96f4c6d88f8e9e9681f731f74
> SHA2-256(exim-pdf-4.100-RC2.tar.xz)=
> c1dd778b2db0c63f76cf1c93710c367d905e6e475360e59c19be80de3351c1a1
> SHA2-256(exim-postscript-4.100-RC2.tar.bz2)=
> 929d63aaf583f66d58d7fed16da9ee44cdf8cdb045c0602d6f008955613f34f7
> SHA2-256(exim-postscript-4.100-RC2.tar.gz)=
> c6268044aeea7e9ae2b9cdbb24a94f953226690b2f273178faa18c0ee7b5e15d
> SHA2-256(exim-postscript-4.100-RC2.tar.xz)=
> 45e55f4658725bf9ec118eeee3236629818cf2e1d3b983a66358079156716ee0
> SHA2-256(exim-texinfo-4.100-RC2.tar.bz2)=
> c17333623da7f48efe03ed9ed7231bc38f75a2aa9f6d6235258a8ad4cb226e9a
> SHA2-256(exim-texinfo-4.100-RC2.tar.gz)=
> ea3ec79cfd669ea147a289d1d0a90d02485141aad0b37d0944a05493ec7ed3d7
> SHA2-256(exim-texinfo-4.100-RC2.tar.xz)=
> f439768669e455ce933375488d10886f2f01f50ed34c3071e9a079ae489930cf
>


-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki
signature.asc (application/pgp-signature, 525 B)