qmail remote vulnerablity?
Today someone posted a patch to qmail 1.0.3 and pointed out this.
I have a quick patch to this issue, hope it’s correct.
A revised patch that correct the last one I posted here.
— qmail-smtpd.c.orig Mon Jan 19 23:20:38 2004
+++ qmail-smtpd.c Mon Jan 19 23:22:36 2004
@@ -305,7 +305,7 @@
*hops = 0;
flaginheader = 1;
pos = 0; flagmaybex = flagmaybey = flagmaybez = 1;
- for (;;) {
- for (;;((*hops) < MAXHOPS)) {
substdio_get(&ssin,&ch,1);
if (flaginheader) {
if (pos < 9) {
@@ -317,7 +317,17 @@
if (pos < 2) if (ch != “\r\n”[pos]) flagmaybey = 0;
if (flagmaybey) if (pos == 1) flaginheader = 0;
}
- ++pos;
- if((++pos) > 1000) {
- /*
- * RFC 2821 has explicitly defined a text line can contain
- * 1000 characters at maximium. This is a workaround to
- * stop copying characters there, but I am not sure about
- * the side effect. Consider this as an attack and set hops
- * to MAXHOPS to prevent future processing.
- */
- *hops = MAXHOPS;
- break;
- }
if (ch == ‘\n’) { pos = 0; flagmaybex = flagmaybey = flagmaybez = 1; }
}
switch(state) {