diff options
| -rw-r--r-- | mailutils/sendmail.c | 53 |
1 files changed, 41 insertions, 12 deletions
diff --git a/mailutils/sendmail.c b/mailutils/sendmail.c index 014b20dc8..a216d66c1 100644 --- a/mailutils/sendmail.c +++ b/mailutils/sendmail.c @@ -9,6 +9,10 @@ #include "libbb.h" #include "mail.h" +// limit maximum allowed number of headers to prevent overflows. +// set to 0 to not limit +#define MAX_HEADERS 256 + static int smtp_checkp(const char *fmt, const char *param, int code) { char *answer; @@ -55,7 +59,9 @@ static char *sane_address(char *str) static void rcptto(const char *s) { - smtp_checkp("RCPT TO:<%s>", s, 250); + // N.B. we don't die if recipient is rejected, for the other recipients may be accepted + if (250 != smtp_checkp("RCPT TO:<%s>", s, -1)) + bb_error_msg("Bad recipient: <%s>", s); } int sendmail_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE; @@ -66,6 +72,7 @@ int sendmail_main(int argc UNUSED_PARAM, char **argv) char *s; llist_t *list = NULL; char *domain = sane_address(safe_getdomainname()); + unsigned nheaders = 0; int code; enum { @@ -197,6 +204,7 @@ int sendmail_main(int argc UNUSED_PARAM, char **argv) // and then use the rest of stdin as message body code = 0; // set "analyze headers" mode while ((s = xmalloc_fgetline(G.fp0)) != NULL) { + dump: // put message lines doubling leading dots if (code) { // escape leading dots @@ -215,41 +223,62 @@ int sendmail_main(int argc UNUSED_PARAM, char **argv) // To: or Cc: headers add recipients if (0 == strncasecmp("To: ", s, 4) || 0 == strncasecmp("Bcc: " + 1, s, 4)) { rcptto(sane_address(s+4)); -// goto addh; - llist_add_to_end(&list, s); + goto addheader; // Bcc: header adds blind copy (hidden) recipient } else if (0 == strncasecmp("Bcc: ", s, 5)) { rcptto(sane_address(s+5)); free(s); // N.B. Bcc: vanishes from headers! // other headers go verbatim - } else if (s[0]) { -// addh: + // N.B. we allow MAX_HEADERS generic headers at most to prevent attacks + } else if (strchr(s, ':')) { + addheader: + if (MAX_HEADERS && ++nheaders >= MAX_HEADERS) + goto bail; llist_add_to_end(&list, s); - // the empty line stops analyzing headers + // a line without ":" (an empty line too, by definition) doesn't look like a valid header + // so stop "analyze headers" mode } else { - free(s); + reenter: // put recipients specified on cmdline while (*argv) { - s = sane_address(*argv); - rcptto(s); - llist_add_to_end(&list, xasprintf("To: %s", s)); + char *t = sane_address(*argv); + rcptto(t); + //if (MAX_HEADERS && ++nheaders >= MAX_HEADERS) + // goto bail; + llist_add_to_end(&list, xasprintf("To: %s", t)); argv++; } // enter "put message" mode - smtp_check("DATA", 354); + // N.B. DATA fails iff no recipients were accepted (or even provided) + // in this case just bail out gracefully + if (354 != smtp_check("DATA", -1)) + goto bail; // dump the headers while (list) { printf("%s\r\n", (char *) llist_pop(&list)); } - printf("%s\r\n" + 2); // quirk for format string to be reused // stop analyzing headers code++; + // N.B. !s means: we read nothing, and nothing to be read in the future. + // just dump empty line and break the loop + if (!s) { + puts("\r"); + break; + } + // go dump message body + // N.B. "s" already contains the first non-header line, so pretend we read it from input + goto dump; } } + // odd case: we didn't stop "analyze headers" mode -> message body is empty. Reenter the loop + // N.B. after reenter code will be > 0 + if (!code) + goto reenter; // finalize the message smtp_check(".", 250); + bail: // ... and say goodbye smtp_check("QUIT", 221); // cleanup |