bb687e1b39
Workaround: "You are not vulnerable if <...> you put this at the start of an ACL plumbed into acl_smtp_connect or acl_smtp_rcpt: warn control = dkim_disable_verify" This is backported from the diff between exim 4.80 and 4.80.1 (not updating fully to 4.80.1 yet as this small diff is safer to commit) same diff rpointel@
14 lines
472 B
Plaintext
14 lines
472 B
Plaintext
$OpenBSD: patch-src_dkim_c,v 1.1 2012/10/26 08:50:01 sthen Exp $
|
|
--- src/dkim.c.orig Mon Oct 10 06:18:13 2011
|
|
+++ src/dkim.c Fri Oct 26 09:39:14 2012
|
|
@@ -42,6 +42,9 @@ int dkim_exim_query_dns_txt(char *name, char *answer)
|
|
"%.*s", (int)len, (char *)((rr->data)+rr_offset));
|
|
rr_offset+=len;
|
|
answer_offset+=len;
|
|
+ if (answer_offset >= PDKIM_DNS_TXT_MAX_RECLEN) {
|
|
+ return PDKIM_FAIL;
|
|
+ }
|
|
}
|
|
}
|
|
else return PDKIM_FAIL;
|