diff options
| author | Omar Polo <op@cvs.openbsd.org> | 2024-03-20 17:52:44 +0000 |
|---|---|---|
| committer | Omar Polo <op@cvs.openbsd.org> | 2024-03-20 17:52:44 +0000 |
| commit | d85495dface090a6fb4eba2ac247d42573910a53 (patch) | |
| tree | 964c58a60e5915908640f8632b3cd2cd54193d97 /usr.sbin/smtpd/smtp_session.c | |
| parent | 4c227e25c86375df6e383135ad378a30c7a03c84 (diff) | |
fix ORCPT handling
due to a swapped strlcpy() arguments we don't save the ORCPT argument
after validation. There's no buffer overflow since dsn_orcpt is zeroed.
Spotted by Tassilo Philipp, thanks!
ok millert gilles
Diffstat (limited to 'usr.sbin/smtpd/smtp_session.c')
| -rw-r--r-- | usr.sbin/smtpd/smtp_session.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/usr.sbin/smtpd/smtp_session.c b/usr.sbin/smtpd/smtp_session.c index 3a99cb4f6b9..b72d2959182 100644 --- a/usr.sbin/smtpd/smtp_session.c +++ b/usr.sbin/smtpd/smtp_session.c @@ -1,4 +1,4 @@ -/* $OpenBSD: smtp_session.c,v 1.441 2024/01/28 17:23:17 op Exp $ */ +/* $OpenBSD: smtp_session.c,v 1.442 2024/03/20 17:52:43 op Exp $ */ /* * Copyright (c) 2008 Gilles Chehade <gilles@poolp.org> @@ -2481,7 +2481,7 @@ smtp_tx_rcpt_to(struct smtp_tx *tx, const char *line) if ((p = strchr(opt, ';')) == NULL || !valid_xtext(p + 1) || - strlcpy(opt, tx->evp.dsn_orcpt, len) >= len) { + strlcpy(tx->evp.dsn_orcpt, opt, len) >= len) { smtp_reply(tx->session, "553 ORCPT address syntax error"); return; |