postfix-2.2.10

diff --git a/postfix/HISTORY b/postfix/HISTORY
index 6515148ae5771e225a4630d854b4405ac1fd80f2..0c85ec7f444b48b2343aa29aa2b143d4eb73fbcf 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -10897,3 +10897,26 @@ Apologies for any names omitted.
 20060403
        Bugfix: the pipe-to-command error message was lost when the
        command could not be executed. File: global/pipe_command.c.
+
+20060404
+
+       Bugfix in sanity check: after reading a record from the
+       address verification database, a sanity check did not reject
+       a record with all-zero time stamp fields.  Such records are
+       never written; the test is there just in case something is
+       broken, so that Postfix will not blindly march on and create
+       chaos. The sanity check tested pointer values, instead of
+       dereferencing the pointers.  Found by Coverity.  File:
+       verify/verify.c.
+
+       Bugfix in sanity check: when the maildir delivery routine
+       opens an output file it looks up the file attributes via
+       the file handle it just got.  There is a sanity check that
+       detects if the attribute lookup fails, an error that never
+       happens. The code that handles the impossible error did not
+       close the output file. This would cause a virtual or local
+       delivery agent to waste up to 100 file descriptors.  But
+       for that error to happen the system would have to be so
+       sick that you would have more serious problems than a file
+       descriptor leak.  Found by Coverity.  Files: local/maildir.c,
+       virtual/maildir.c.

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 722d611992840393109874c098cae501371fbbdf..faad697b670e26252c32b5fb45f2929833eda293 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change the patchlevel and the release date. Snapshots change the
   * release date only.
   */
-#define MAIL_RELEASE_DATE      "20060403"
-#define MAIL_VERSION_NUMBER    "2.2.10-RC2"
+#define MAIL_RELEASE_DATE      "20060405"
+#define MAIL_VERSION_NUMBER    "2.2.10"
 
 #define VAR_MAIL_VERSION       "mail_version"
 #ifdef SNAPSHOT

diff --git a/postfix/src/local/maildir.c b/postfix/src/local/maildir.c
index 5d0ab04af84d3baba03b19689ad199727d74e0cb..d44d463329daa36a55a8b63148605a1350164b23 100644 (file)
--- a/postfix/src/local/maildir.c
+++ b/postfix/src/local/maildir.c
@@ -189,7 +189,13 @@ int     deliver_maildir(LOCAL_STATE state, USER_ATTR usr_attr, char *path)
            || (dst = vstream_fopen(tmpfile, O_WRONLY | O_CREAT | O_EXCL, 0600)) == 0)) {
        vstring_sprintf(why, "create %s: %m", tmpfile);
     } else if (fstat(vstream_fileno(dst), &st) < 0) {
-       vstring_sprintf(why, "create %s: %m", tmpfile);
+
+       /*
+        * Coverity 200604: file descriptor leak in code that never executes.
+        * Code replaced by msg_fatal(), as it is not worthwhile to continue
+        * after an impossible error condition.
+        */
+       msg_fatal("fstat %s: %m", tmpfile);
     } else {
        vstring_sprintf(buf, "%lu.V%lxI%lxM%lu.%s",
                        (unsigned long) starttime.tv_sec,

diff --git a/postfix/src/verify/verify.c b/postfix/src/verify/verify.c
index 71f32dcb002239cb58fb44e2b3c96b897d7178ea..cf4d1d3d2069b41a41901f65dc8bb5c06a337cdd 100644 (file)
--- a/postfix/src/verify/verify.c
+++ b/postfix/src/verify/verify.c
@@ -266,11 +266,18 @@ static int verify_parse_entry(char *buf, int *status, long *probed,
        *probed = atol(probed_text);
        *updated = atol(updated_text);
        *status = atoi(buf);
+
+       /*
+        * Coverity 200604: the code incorrectly tested (probed || updated),
+        * so that the sanity check never detected all-zero time stamps. Such
+        * records are never written. If we read a record with all-zero time
+        * stamps, then something is badly broken.
+        */
        if ((*status == DEL_RCPT_STAT_OK
             || *status == DEL_RCPT_STAT_DEFER
             || *status == DEL_RCPT_STAT_BOUNCE
             || *status == DEL_RCPT_STAT_TODO)
-           && (probed || updated))
+           && (*probed || *updated))
            return (0);
     }
     msg_warn("bad address verify table entry: %.100s", buf);

diff --git a/postfix/src/virtual/maildir.c b/postfix/src/virtual/maildir.c
index b7f46bddd1f00b8f909bac93938c75fe8acf09cf..6b7a0820344fc7f17badc24bc24b937825db6d28 100644 (file)
--- a/postfix/src/virtual/maildir.c
+++ b/postfix/src/virtual/maildir.c
@@ -187,7 +187,13 @@ int     deliver_maildir(LOCAL_STATE state, USER_ATTR usr_attr)
            || (dst = vstream_fopen(tmpfile, O_WRONLY | O_CREAT | O_EXCL, 0600)) == 0)) {
        vstring_sprintf(why, "create %s: %m", tmpfile);
     } else if (fstat(vstream_fileno(dst), &st) < 0) {
-       vstring_sprintf(why, "create %s: %m", tmpfile);
+
+       /*
+        * Coverity 200604: file descriptor leak in code that never executes.
+        * Code replaced by msg_fatal(), as it is not worthwhile to continue
+        * after an impossible error condition.
+        */
+       msg_fatal("fstat %s: %m", tmpfile);
     } else {
        vstring_sprintf(buf, "%lu.V%lxI%lxM%lu.%s",
                        (unsigned long) starttime.tv_sec,