postfix-1.1.11-20020928

diff --git a/postfix/HISTORY b/postfix/HISTORY
index 534ec272deb0fc5f45f37e8c699633345a65dfe4..f445677857fce08c94ce118b011e33eb516e821e 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -7024,6 +7024,14 @@ Apologies for any names omitted.
        unavailable, causing the restrictions parser to get out if
        sync. Spotted by Ralf Hildebrandt.  File:  smtpd/smtpd_check.c.
 
+20020928
+
+       Bugfix: missing %s in the 20020923 RBL code. This was not
+       exploitable because Postfix implements only a safe subset
+       of all printf format operators and because memory for the
+       result is dynamically allocated.  Victor Duchovni. File:
+       smtpd/smtpd_check.c.
+
 Open problems:
 
        Low: smtpd should log queue ID with reject/warn/hold/discard

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 6319c6598c0ff69f85c3a28c9a6a7668cd0092df..c5405dd5fcb7414e690e212ddc704ba1fa724906 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,7 +20,7 @@
   * Patches change the patchlevel and the release date. Snapshots change the
   * release date only, unless they include the same bugfix as a patch release.
   */
-#define MAIL_RELEASE_DATE      "20020924"
+#define MAIL_RELEASE_DATE      "20020928"
 
 #define VAR_MAIL_VERSION       "mail_version"
 #define DEF_MAIL_VERSION       "1.1.11-" MAIL_RELEASE_DATE

diff --git a/postfix/src/smtpd/smtpd_check.c b/postfix/src/smtpd/smtpd_check.c
index 6e78d30fd1868daee4c44adb99c2a9e5ecef55d1..9fe7cfed27b0f0d82db7a607b775fce91c0a32ca 100644 (file)
--- a/postfix/src/smtpd/smtpd_check.c
+++ b/postfix/src/smtpd/smtpd_check.c
@@ -448,7 +448,7 @@ static void PRINTFLIKE(3, 4) defer_if(SMTPD_DEFER *, int, const char *,...);
   * Cached RBL lookup state.
   */
 typedef struct {
-    char   *txt;                       /* TXT record or null */
+    char   *txt;                       /* TXT record or "" */
 } SMTPD_RBL_STATE;
 
 static void *rbl_pagein(const char *, void *);
@@ -2348,7 +2348,7 @@ static int rbl_reject_reply(SMTPD_STATE *state, SMTPD_RBL_STATE *rbl,
                 myname, rbl_domain, template);
        template = 0;                           /* pretend not found */
     }
-    result = smtpd_check_reject(state, MAIL_ERROR_POLICY, STR(why));
+    result = smtpd_check_reject(state, MAIL_ERROR_POLICY, "%s", STR(why));
 
     /*
      * Clean up.